Need Help with "Your Protection" Virus

dying of frustration · Apr 8, 2010

So, I am having trouble because somehow "Your Protection" was downloaded onto my computer. I have run scans from Spybot SD, Malwarebytes, and AVG, which have all come up with threats and supposedly removed them. The problem is, more keep appearing. I looked into it, and I found out that the tdss rootkit may be at the bottom of it. So, I downloaded Kaspersky's tdsskiller program, and I discovered that in fact I was infected. The only thing is, the prgram found it, but it apparently can't "cure" it. So, I think I need to first get rid of that before I can remove "your Protection" and everything else. At least, that's my speculation, but I don't know for sure. So, you think you can help, or am I pretty much hosed?

Here is my HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:32:35 PM, on 4/8/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\LxrSII1s.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Documents and Settings\Brian\Local Settings\Application Data\Lexar Media\LxrAutorun.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\PIXELA\ImageMixer 3 SE Ver.4.5\Transfer Utility\CameraMonitor.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardTools.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\Aware.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\Marker.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/webscout/{213687C0-A8F8-4791-AD1C-94B40145C34C}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/webscout/{213687C0-A8F8-4791-AD1C-94B40145C34C}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - *{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - *{8567a644-e36c-470c-86cf-9c5b4f37db81} - (no file)
R3 - URLSearchHook: (no name) - *{CA3EB689-8F09-4026-AA10-B9534C691CE0} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies Inc\Notebook Software\NotebookPlugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Online Sharing Toolbar - {8567a644-e36c-470c-86cf-9c5b4f37db81} - C:\Program Files\Online_Sharing\tbOnli.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Internet Explorer Plugin - {F4F5B58A-D3A6-4F85-B3EF-5642E8937E6F} - nsfwj2.dll (file missing)
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: Online Sharing Toolbar - {8567a644-e36c-470c-86cf-9c5b4f37db81} - C:\Program Files\Online_Sharing\tbOnli.dll
O4 - HKLM\..\Run: [QUICKCARE] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKCU\..\Run: [LxrAutorun] C:\Documents and Settings\Brian\Local Settings\Application Data\Lexar Media\LxrAutorun.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103472 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; Media Center PC 4.0; MSN Optimized;US)" -"http://www.regentsprep.org/Regents/physics/phys01/friction/default.htm"
O4 - HKUS\S-1-5-18\..\Run: [mplay32xe.exe] C:\WINDOWS\TEMP\mplay32xe.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Your Protection] "C:\Program Files\Your Protection\urpprot.exe" -noscan (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [mplay32xe.exe] C:\WINDOWS\TEMP\mplay32xe.exe (User 'Default user')
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: ImageMixer 3 SE Camera Monitor Ver.4.5.lnk = ?
O4 - Global Startup: SMART Board Tools.lnk = C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardTools.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1234169145515
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: Google Update Service (gupdate1ca56ab8e11c5ea) (gupdate1ca56ab8e11c5ea) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSII1s.exe
O23 - Service: SMART Board Service - SMART Technologies Inc. - C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
O23 - Service: SMART Web Server - Unknown owner - C:\Program Files\SMART Technologies Inc\SMART Board Software\WebServer.exe

--
End of file - 11480 bytes

Thanks in advance.

Blade81 · Apr 12, 2010

Hi,

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

When done, DDS will open two (2) logs:
1. DDS.txt
2. Attach.txt
Save both reports to your desktop. Post them back to your topic.

--

Download GMER here by clicking download exe -button and then saving it your desktop:

Double-click .exe that you downloaded
Click rootkit-tab, unselect files and then click scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log (if the log is long, archive it into a zip file and attach instead of posting) in your reply.

dying of frustration · Apr 12, 2010

Sorry I haven't replied sooner. I have been trying to use gmer, but every time I do it completely freezes my computer. I'll keep trying with it, but for now, here are my dds.txt and attach.txt logs (attached).

dying of frustration · Apr 13, 2010

Finally!!! After 12 tries, I got through a scan by GMER. The log is attached.

Blade81 · Apr 13, 2010

Hi,

Next time, please post contents of logs instead of attaching them as files.

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

DNA

I'd like you to read this thread.

Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).

After that:

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers.
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

--

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully first.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

dying of frustration · Apr 13, 2010

I'm actually not sure what DNA is. I know I used utorrent a while back but that's been uninstalled for a while now. I tried to find DNA in the Add/Remove programs list, but it's not there. I also used the search tool to find any files under that name, but all I found was a 10.8 kb folder that contains application data, though I again don't know what it goes to, exactly. I can delete the application data folder if you want me too, and maybe that will remove it from the list.

I just wanted to check this bit out first before I started defogger and combofix.:thanks:

Blade81 · Apr 13, 2010

Hi,

Continue with defogger & ComboFix then

dying of frustration · Apr 13, 2010

Everything's done. Here's the log.

ComboFix 10-04-13.02 - Brian 04/13/2010 12:37:03.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.398 [GMT -7:00]
Running from: c:\documents and settings\Brian\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\8SOejo8n.exe
c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
c:\windows\system32\fsc.txt
c:\windows\system32\ide.txt
c:\windows\system32\klgd.bmp
c:\windows\system32\qks.txt

.
((((((((((((((((((((((((( Files Created from 2010-03-13 to 2010-04-13 )))))))))))))))))))))))))))))))
.

2010-04-13 06:00 . 2010-04-13 16:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\AskToolbar
2010-04-13 05:59 . 2010-04-13 05:59 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Conduit
2010-04-13 05:59 . 2010-04-13 06:00 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Online_Sharing
2010-04-12 21:20 . 2010-04-12 21:20 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-04-11 03:45 . 2010-04-11 03:45 -------- d-----w- c:\program files\iPod
2010-04-11 03:45 . 2010-04-11 03:46 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-11 03:42 . 2010-04-11 03:42 -------- d-----w- c:\program files\Apple Software Update
2010-04-09 06:37 . 2010-04-13 19:14 -------- d-----w- c:\program files\Inbox
2010-04-09 06:10 . 2010-04-13 19:13 -------- d-----w- c:\documents and settings\Brian\Tracing
2010-04-09 05:59 . 2010-04-09 05:59 -------- d-----w- c:\program files\Microsoft Sync Framework
2010-04-09 05:52 . 2010-04-09 05:52 -------- d-----w- c:\program files\Microsoft
2010-04-09 05:52 . 2010-04-09 05:52 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-04-09 05:44 . 2010-04-09 05:44 -------- d-----w- c:\program files\Common Files\Windows Live
2010-04-09 05:17 . 2010-04-12 19:57 -------- d-----w- c:\documents and settings\Brian\Local Settings\Application Data\AskToolbar
2010-04-09 05:16 . 2010-04-09 05:16 -------- d-----w- c:\program files\Ask.com
2010-04-08 18:24 . 2010-04-08 18:24 45568 ----a-w- c:\windows\system32\nsfwj2.dll
2010-04-08 16:16 . 2010-04-08 16:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-04-08 16:14 . 2010-04-08 16:14 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-04-07 00:28 . 2010-04-07 00:28 -------- d-----w- c:\program files\SEKILALA
2010-04-06 23:59 . 2010-04-06 23:59 125952 ----a-w- c:\documents and settings\All Users\Application Data\ParetoLogic\UUS2\Temp\Update.exe
2010-04-06 23:50 . 2010-04-07 22:02 32032 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-04-06 23:50 . 2010-04-07 22:01 5350944 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-04-06 23:45 . 2010-04-07 22:12 -------- d-----w- c:\documents and settings\All Users\Application Data\RegCure
2010-04-06 23:31 . 2010-04-07 21:49 -------- d-----w- c:\program files\Common Files\ParetoLogic
2010-04-06 23:31 . 2010-04-07 21:49 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-04-06 23:30 . 2010-04-06 23:30 -------- d-----w- c:\documents and settings\Brian\Local Settings\Application Data\Downloaded Installations
2010-04-06 22:52 . 2010-04-06 22:54 -------- d-----w- c:\documents and settings\Brian\Application Data\GetRightToGo
2010-04-06 22:49 . 2010-04-06 23:14 79488 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\jre1.6.0_19\gtapi.dll
2010-04-06 22:49 . 2010-04-06 23:14 152576 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\jre1.6.0_19\lzma.dll
2010-04-06 21:21 . 2010-04-13 00:37 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-04-06 11:57 . 2010-04-06 11:57 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-06 11:56 . 2010-04-06 11:57 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-06 09:00 . 2010-04-06 09:00 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-04-06 04:16 . 2010-04-08 15:39 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-06 01:30 . 2010-04-07 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Pixela
2010-04-06 01:27 . 2010-04-06 01:28 -------- d-----w- c:\program files\PIXELA
2010-04-05 10:20 . 2010-04-05 10:20 -------- d-sh--w- c:\documents and settings\NetworkService\PrivacIE
2010-04-01 07:35 . 2010-04-01 07:59 -------- d-----w- c:\program files\Project64 1.6
2010-04-01 04:14 . 2010-04-01 04:14 61440 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-72781112-n\decora-sse.dll
2010-04-01 04:14 . 2010-04-01 04:14 503808 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-70ee7950-n\msvcp71.dll
2010-04-01 04:14 . 2010-04-01 04:14 499712 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-70ee7950-n\jmc.dll
2010-04-01 04:14 . 2010-04-01 04:14 348160 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-70ee7950-n\msvcr71.dll
2010-04-01 04:14 . 2010-04-01 04:14 12800 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-72781112-n\decora-d3d.dll
2010-03-31 18:28 . 2010-03-31 18:28 50192 ----a-w- c:\documents and settings\Others\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-31 17:52 . 2010-03-31 17:52 -------- d-----w- c:\documents and settings\Others\Local Settings\Application Data\Mozilla
2010-03-31 17:32 . 2010-03-31 17:32 -------- d-----w- c:\documents and settings\Others\Application Data\SMART Technologies Inc
2010-03-31 17:32 . 2010-03-31 17:32 -------- d-----w- c:\documents and settings\Others\Local Settings\Application Data\Apple Computer
2010-03-31 17:32 . 2010-03-31 17:32 -------- d-----w- c:\documents and settings\Others\Local Settings\Application Data\SupportSoft
2010-03-31 17:12 . 2010-03-31 17:12 -------- d-----w- c:\documents and settings\Guest\Application Data\SMART Technologies Inc
2010-03-29 23:46 . 2010-04-12 20:22 -------- d-----w- c:\program files\DISCIPLINE
2010-03-29 19:44 . 2010-04-12 20:20 -------- d-----w- c:\program files\Kira Kira
2010-03-29 09:50 . 2010-03-29 09:50 -------- d-----w- c:\program files\directx
2010-03-29 09:37 . 2008-03-05 23:03 479752 ----a-w- c:\windows\system32\XAudio2_0.dll
2010-03-29 09:35 . 2010-03-29 09:35 -------- d-----w- c:\windows\Logs
2010-03-26 08:48 . 2010-03-26 08:48 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-03-24 17:12 . 2010-04-02 19:59 -------- d-----w- c:\program files\Will
2010-03-18 22:30 . 2010-03-29 20:49 -------- d-----w- c:\program files\ZyX
2010-03-18 10:09 . 2010-03-18 10:09 -------- d-----w- c:\windows\system32\XPSViewer
2010-03-18 10:09 . 2010-03-18 10:09 -------- d-----w- c:\program files\MSBuild
2010-03-18 10:08 . 2010-03-18 10:08 -------- d-----w- c:\program files\Reference Assemblies
2010-03-18 10:08 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-03-18 10:07 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-03-18 10:07 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-03-18 10:07 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-03-18 10:07 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-03-18 10:07 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-03-18 10:07 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-03-18 10:07 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-03-18 10:07 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-03-18 10:07 . 2010-03-18 10:08 -------- d-----w- C:\171eaa7061309267e3f8a3d06a4eb1fd
2010-03-18 10:04 . 2010-03-18 10:04 -------- d-----w- c:\program files\Essentials Codec Pack
2010-03-18 06:12 . 2010-03-18 06:12 -------- d-----w- c:\documents and settings\Brian\Application Data\Freedom Scientific
2010-03-18 06:11 . 2010-03-18 06:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Freedom Scientific
2010-03-18 06:11 . 2010-03-18 06:11 -------- d-----w- c:\program files\ssce
2010-03-18 06:00 . 2006-02-10 04:58 256512 ----a-w- c:\windows\system32\dcmc0d0.dll
2010-03-18 06:00 . 2010-03-18 06:11 -------- d--h--w- c:\program files\Freedom Scientific Installation Information
2010-03-18 06:00 . 2010-03-18 06:00 -------- d-----w- c:\windows\system32\HJSMEM
2010-03-18 06:00 . 2010-03-18 06:11 -------- d-----w- c:\program files\Freedom Scientific
2010-03-18 05:54 . 2010-03-18 05:54 -------- d-----w- c:\program files\Bonjour
2010-03-18 05:42 . 2010-03-18 05:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Deskshare
2010-03-18 05:40 . 2010-03-18 05:40 -------- d-----w- c:\windows\XSxS
2010-03-18 05:40 . 2010-03-18 05:40 -------- d-----w- c:\program files\Xenocode
2010-03-18 05:40 . 2010-03-18 05:40 -------- d-----w- c:\documents and settings\Brian\Local Settings\Application Data\Xenocode
2010-03-18 05:39 . 2010-03-18 05:39 -------- d-----w- c:\program files\Common Files\DeskShare Shared
2010-03-18 05:39 . 2010-03-18 05:39 -------- d-----w- c:\program files\Deskshare
2010-03-18 05:38 . 2010-03-18 05:39 -------- d-----w- c:\windows\speech
2010-03-18 05:38 . 2010-03-18 05:38 -------- d-----w- c:\program files\ATTNaturalVoices
2010-03-17 09:29 . 2010-03-17 09:34 -------- d-----w- c:\program files\BBLACK
2010-03-16 09:59 . 2010-03-16 09:59 29926 ----a-r- c:\documents and settings\Brian\Application Data\Microsoft\Installer\{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_18be6784.exe
2010-03-16 09:59 . 2010-03-16 09:59 29422 ----a-r- c:\documents and settings\Brian\Application Data\Microsoft\Installer\{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_294823.exe
2010-03-16 09:33 . 2001-08-23 09:00 6144 -c--a-w- c:\windows\system32\dllcache\kbd101a.dll
2010-03-16 08:38 . 1999-12-17 16:13 86016 ----a-w- c:\windows\unvise32.exe
2010-03-16 08:34 . 2010-04-12 20:20 -------- d-----w- c:\program files\Yin-Yang
2010-03-16 08:00 . 2010-04-12 20:21 -------- d-----w- c:\program files\Amorous Professor Cherry
2010-03-16 07:37 . 2010-03-16 07:37 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-16 07:36 . 2010-03-16 07:58 -------- d-----w- c:\documents and settings\Brian\Application Data\DAEMON Tools Lite
2010-03-16 07:36 . 2010-03-16 07:36 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-13 14:58 . 2010-04-05 10:18 112 ----a-w- c:\documents and settings\All Users\Application Data\58q7uu.dat
2010-04-13 05:29 . 2004-08-10 12:00 36352 ----a-w- c:\windows\system32\drivers\disk.sys
2010-04-13 00:34 . 2004-08-10 12:00 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-04-12 21:20 . 2010-04-12 21:20 41472 ----a-w- c:\windows\Fonts\N2BMLre6S.com
2010-04-11 03:46 . 2010-03-06 19:54 -------- d-----w- c:\program files\iTunes
2010-04-11 03:45 . 2008-01-05 21:26 -------- d-----w- c:\program files\Common Files\Apple
2010-04-09 06:01 . 2007-12-07 00:44 50776 ----a-w- c:\documents and settings\Brian\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-09 06:00 . 2008-03-03 19:41 -------- d-----w- c:\program files\Windows Live
2010-04-09 05:59 . 2007-12-10 01:52 -------- d-----w- c:\program files\Windows Live Toolbar
2010-04-08 15:50 . 2008-08-20 00:19 -------- d-----w- c:\program files\AVG
2010-04-08 15:50 . 2008-08-20 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2010-04-07 21:55 . 2009-06-25 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-04-06 23:50 . 2010-04-06 23:50 32 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-04-06 23:50 . 2010-04-06 23:50 32 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-04-06 23:02 . 2009-12-12 19:51 -------- d-----w- c:\program files\QuickTime
2010-04-06 22:53 . 2008-12-15 17:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-04-06 22:43 . 2008-03-05 17:38 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-06 21:04 . 2007-12-06 23:56 -------- d-----w- c:\program files\dl_Cats
2010-04-06 02:05 . 2007-10-30 20:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-06 01:19 . 2009-01-03 20:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-06 01:19 . 2009-01-15 06:40 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-05 09:52 . 2008-11-11 22:35 1 ----a-w- c:\documents and settings\Brian\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-03 03:48 . 2007-12-20 09:47 56 --sh--r- c:\windows\system32\0E64EFB052.sys
2010-04-03 03:48 . 2007-12-20 09:47 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
2010-03-30 07:46 . 2009-01-03 20:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 07:45 . 2009-01-03 20:22 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-29 07:08 . 2008-02-07 18:42 -------- d-----w- c:\documents and settings\Brian\Application Data\Jasc Software Inc
2010-03-18 22:15 . 2008-03-25 03:09 -------- d-----w- c:\program files\CCleaner
2010-03-18 22:01 . 2008-05-22 16:37 -------- d-----w- c:\documents and settings\Brian\Application Data\Uniblue
2010-03-18 20:43 . 2009-01-10 08:32 -------- d-----w- c:\program files\VideoLAN
2010-03-18 06:25 . 2008-04-23 18:40 2000000 ----atw- c:\windows\system32\HJSMEM.DAT
2010-03-18 05:55 . 2009-09-06 23:53 -------- d-----w- c:\program files\Safari
2010-03-11 10:03 . 2008-10-19 07:58 -------- d-----w- c:\program files\ffdshow
2010-03-11 10:03 . 2008-05-22 16:19 -------- d-----w- c:\program files\Free Offers from Freeze.com
2010-03-10 21:19 . 2007-12-07 05:27 -------- d-----w- c:\documents and settings\All Users\Application Data\SupportSoft
2010-03-05 11:47 . 2008-10-10 19:00 -------- d-----w- c:\documents and settings\Brian\Application Data\Move Networks
2010-03-04 11:45 . 2007-12-09 20:35 -------- d-----w- c:\program files\DivX
2010-03-04 11:43 . 2009-10-27 02:16 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-03-04 11:00 . 2010-03-04 11:00 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-02 06:55 . 2007-10-30 21:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-02 05:33 . 2009-06-23 04:32 315736 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-03-02 05:33 . 2009-06-23 04:32 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2010-03-02 05:33 . 2009-06-23 04:32 173408 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-03-02 05:33 . 2009-06-02 04:33 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-02 05:33 . 2009-06-23 04:32 350544 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-03-02 05:33 . 2009-06-23 04:32 303456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-03-02 05:33 . 2009-06-23 04:32 1630560 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-02 05:33 . 2009-06-02 04:33 89952 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-03-02 05:33 . 2009-06-02 04:32 254832 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-03-02 05:32 . 2009-06-23 04:32 671592 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-03-02 05:32 . 2009-06-02 04:32 45408 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-03-02 05:32 . 2009-09-29 04:32 3701760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-03-02 05:32 . 2009-06-23 04:32 566648 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-03-02 05:32 . 2009-06-23 04:32 567144 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-03-02 05:32 . 2009-06-23 04:32 2357064 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-03-02 05:32 . 2009-06-23 04:32 524632 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-03-02 05:32 . 2009-06-23 04:32 1029456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-03-01 05:41 . 2010-03-01 05:41 -------- d-----w- c:\program files\NaturalSoft
2010-02-25 06:24 . 2004-08-10 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 13:45 . 2010-02-22 22:10 7 ----a-w- c:\windows\sbacknt.bin
2010-02-23 06:28 . 2010-02-23 05:58 -------- d-----w- c:\documents and settings\Brian\Application Data\Toolbar4
2010-02-23 05:40 . 2010-02-23 05:40 -------- d-----w- c:\program files\Conduit
2010-02-23 05:40 . 2010-02-23 05:40 -------- d-----w- c:\program files\Online_Sharing
2010-02-17 00:11 . 2007-10-30 21:09 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-14 09:36 . 2010-02-14 09:36 -------- d-----w- c:\program files\RADVideo
2010-02-14 09:28 . 2010-02-14 09:28 -------- d-----w- c:\program files\Common Files\Common Share
2010-02-13 00:21 . 2008-01-05 21:28 -------- d-----w- c:\documents and settings\Brian\Application Data\Apple Computer
2010-02-12 18:46 . 2010-02-12 18:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46 . 2010-02-12 18:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-02-04 17:01 . 2010-03-29 09:38 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 17:01 . 2010-03-29 09:38 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 17:01 . 2010-03-29 09:38 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 17:01 . 2010-03-29 09:38 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-01-27 08:08 . 2008-10-19 07:58 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-01-27 05:38 . 2010-01-27 05:38 348160 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4f12d232-n\msvcr71.dll
2010-01-27 05:38 . 2010-01-27 05:38 61440 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-126fe1bb-n\decora-sse.dll
2010-01-27 05:38 . 2010-01-27 05:38 503808 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4f12d232-n\msvcp71.dll
2010-01-27 05:38 . 2010-01-27 05:38 499712 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4f12d232-n\jmc.dll
2010-01-27 05:38 . 2010-01-27 05:38 12800 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-126fe1bb-n\decora-d3d.dll
.

Code:

<pre>
c:\program files\Adobe\Reader 9.0\Reader\Reader_sl .exe
c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier .exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\DAEMON Tools Lite\DTLite .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\QuickTime\QTTask .exe
c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer .exe
c:\program files\Windows Live\Messenger\msnmsgr     .exe
c:\program files\Windows Live\Messenger\msnmsgr    .exe
c:\program files\Windows Live\Messenger\msnmsgr   .exe
c:\program files\Windows Live\Messenger\msnmsgr  .exe
c:\program files\Windows Live\Messenger\msnmsgr .exe
c:\windows\ime\imjp8_1\IMJPMIG .exe
c:\windows\ime\imkr6_1\IMEKRMIG .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8567a644-e36c-470c-86cf-9c5b4f37db81}]
2009-12-31 19:53 2349080 ----a-w- c:\program files\Online_Sharing\tbOnli.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 21:03 1230080 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 23:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
"{8567a644-e36c-470c-86cf-9c5b4f37db81}"= "c:\program files\Online_Sharing\tbOnli.dll" [2009-12-31 2349080]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CLASSES_ROOT\clsid\{8567a644-e36c-470c-86cf-9c5b4f37db81}]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{8567A644-E36C-470C-86CF-9C5B4F37DB81}"= "c:\program files\Online_Sharing\tbOnli.dll" [2009-12-31 2349080]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{8567a644-e36c-470c-86cf-9c5b4f37db81}]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr .exe" [2009-07-26 3883856]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [N/A]
"LxrAutorun"="c:\documents and settings\Brian\Local Settings\Application Data\Lexar Media\LxrAutorun.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QUICKCARE"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-08 192512]
"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-06-07 69632]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [N/A]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [N/A]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [N/A]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [N/A]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2001-08-23 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Your Protection"="c:\program files\Your Protection\urpprot.exe" [N/A]

c:\documents and settings\Brian\Start Menu\Programs\Startup\
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-6-24 803176]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
ImageMixer 3 SE Camera Monitor Ver.4.5.lnk - c:\program files\PIXELA\ImageMixer 3 SE Ver.4.5\Transfer Utility\CameraMonitor.exe [2010-4-5 406896]
SMART Board Tools.lnk - c:\program files\SMART Technologies Inc\SMART Board Software\SMARTBoardTools.exe [2007-11-2 4519176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-16 19:50 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2006-02-10 05:05 344064 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlccmon.exe]
2005-07-22 19:03 425984 ----a-w- c:\program files\Dell Photo AIO Printer 924\dlccmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 21:56 64512 ----a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-06-16 14:03 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-06-16 14:03 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-26 08:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-12 21:37 41480 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QUICKCARE]
2006-11-08 04:07 192512 ----a-w- c:\program files\Qwest\QuickCare\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 04:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2005-03-23 01:20 339968 ----a-w- c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 23:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
c:\program files\Common Files\Real\Update_OB\realsched.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
2008-08-28 17:18 3660848 ----a-w- c:\program files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"SPF4"=2 (0x2)
"IDriverT"=3 (0x3)
"gusvc"=3 (0x3)
"dlcc_device"=3 (0x3)
"BOCore"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\WINDOWS\\system32\\dlcccoms.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Guild Wars\\Gw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer .exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1/31/2009 10:32 PM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/3/2009 12:41 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/3/2009 12:41 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [1/3/2009 12:41 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/3/2009 12:41 PM 297752]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [9/24/2009 8:15 PM 72672]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 2:34 PM 1029456]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;\??\c:\program files\VMLaunch\BuddyVM.sys --> c:\program files\VMLaunch\BuddyVM.sys [?]
S2 gupdate1ca56ab8e11c5ea;Google Update Service (gupdate1ca56ab8e11c5ea);c:\program files\Google\Update\GoogleUpdate.exe [10/26/2009 7:16 PM 133104]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [10/30/2007 12:56 PM 20160]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 5:20 AM 12648]
S3 SMART Web Server;SMART Web Server;c:\program files\SMART Technologies Inc\SMART Board Software\WebServer.exe [11/2/2007 6:48 AM 767240]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/16/2010 12:37 AM 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A794B62F-01A7-4F56-B1C7-4A568C1BECFF}]
2010-04-08 18:24 45568 ----a-w- c:\windows\system32\nsfwj2.dll
.
Contents of the 'Scheduled Tasks' folder

2010-04-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 05:32]

2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 18:50]

2010-04-13 c:\windows\Tasks\At1.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At10.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At11.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At12.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-12 c:\windows\Tasks\At13.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-11 c:\windows\Tasks\At14.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-11 c:\windows\Tasks\At15.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-12 c:\windows\Tasks\At16.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-12 c:\windows\Tasks\At17.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At18.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At19.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At2.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At20.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At21.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At22.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At23.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At24.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At3.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At4.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At49.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At5.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At50.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At51.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At52.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At53.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At54.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At55.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At56.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At57.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At58.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At59.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At6.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At60.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-12 c:\windows\Tasks\At61.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-12 c:\windows\Tasks\At62.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-12 c:\windows\Tasks\At63.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-12 c:\windows\Tasks\At64.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-12 c:\windows\Tasks\At65.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At66.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At67.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At68.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At69.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At7.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At70.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At71.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At72.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At8.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At9.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-27 02:16]

2010-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-27 02:16]

2010-04-13 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-04 23:50]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.live.com/
mStart Page = hxxp://www.bigseekpro.com/webscout/{213687C0-A8F8-4791-AD1C-94B40145C34C}
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Inbox Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Inbox\ctbr.dll
FF - ProfilePath - c:\documents and settings\Brian\Application Data\Mozilla\Firefox\Profiles\x3ydlwy6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15153&l=dis
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=UT2V5&o=15150&locale=en_US&q=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Inbox\firefox\components\xcomm.dll
FF - component: c:\program files\Inbox\firefox\components\xshared.dll
FF - component: c:\program files\Inbox\firefox\components\xsupport.dll
FF - plugin: c:\documents and settings\Brian\Application Data\Move Networks\plugins\npqmp071505000010.dll
FF - plugin: c:\documents and settings\Brian\Application Data\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-*{8567a644-e36c-470c-86cf-9c5b4f37db81} - (no file)
URLSearchHooks-*{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
SafeBoot-klmdb.sys

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-13 12:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x86EE4AC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf75d6f28
\Driver\ACPI -> ACPI.sys @ 0xf7469cb8
\Driver\atapi -> atapi.sys @ 0xf73fb852
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5d,1a,f6,c6,ac,aa,3a,48,98,4a,c9,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5d,1a,f6,c6,ac,aa,3a,48,98,4a,c9,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(688)
c:\windows\system32\WININET.dll

- - - - - - - > 'lsass.exe'(748)
c:\windows\system32\WININET.dll
.
Completion time: 2010-04-13 12:56:09
ComboFix-quarantined-files.txt 2010-04-13 19:56

Pre-Run: 22,169,628,672 bytes free
Post-Run: 22,300,794,880 bytes free

- - End Of File - - AC8D1ED483CBE67892BF469F17B73B2B

dying of frustration · Apr 14, 2010

Sorry again that it took so long. I had to leave the computer for a while. Here is the dds log. I wasn't sure if you wanted one or both of the logs, so I just posted the one titled dds. If you want the other, just let me know.

Thanks:crowned:

DDS (Ver_10-03-17.01) - NTFSx86
Run by Brian at 20:40:38.84 on Tue 04/13/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_19
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.226 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\LxrSII1s.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr .exe
C:\Program Files\PIXELA\ImageMixer 3 SE Ver.4.5\Transfer Utility\CameraMonitor.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardTools.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\Aware.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\Marker.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Inbox\CToolbar.exe
c:\PROGRA~1\Inbox\CMail.exe
C:\Documents and Settings\All Users\Application Data\8SOejo8n.exe
C:\Documents and Settings\Brian\My Documents\Downloads\dds.com
C:\Program Files\Online_Sharing\Online_SharingToolbarHelper.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.live.com/
mStart Page = hxxp://www.bigseekpro.com/webscout/{213687C0-A8F8-4791-AD1C-94B40145C34C}
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: : {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - c:\progra~1\inbox\ctbr.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: CIEDownload Object: {67bcf957-85fc-4036-8dc4-d4d80e00a77b} - c:\program files\smart technologies inc\notebook software\NotebookPlugin.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Online Sharing Toolbar: {8567a644-e36c-470c-86cf-9c5b4f37db81} - c:\program files\online_sharing\tbOnli.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\program files\megaupload\mega manager\MegaIEMn.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {F4F5B58A-D3A6-4F85-B3EF-5642E8937E6F} - No File
TB: Veoh Browser Plug-in: {d0943516-5076-4020-a3b5-aefaf26ab263} - c:\program files\veoh networks\veoh\plugins\reg\VeohToolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Veoh Web Player Video Finder: {0fbb9689-d3d7-4f7a-a2e2-585b10099bfc} - c:\program files\veoh networks\veohwebplayer\VeohIEToolbar.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: Online Sharing Toolbar: {8567a644-e36c-470c-86cf-9c5b4f37db81} - c:\program files\online_sharing\tbOnli.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Inbox.com Toolbar: {4b3803ea-5230-4dc3-a7fc-33638f3d3542} - c:\progra~1\inbox\ctbr.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No File
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr .exe" /background
uRun: [VeohPlugin] "c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe"
uRun: [LxrAutorun] c:\documents and settings\brian\local settings\application data\lexar media\LxrAutorun.exe
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~2.EXE -Update -1103472 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; Media Center PC 4.0; MSN Optimized;US)" -"http://www.regentsprep.org/Regents/physics/phys01/friction/default.htm"
mRun: [QUICKCARE] c:\program files\qwest\quickcare\bin\sprtcmd.exe /P QUICKCARE
mRun: [DLCCCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCCtime.dll,_RunDLLEntry@16
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRun: [Your Protection] "c:\program files\your protection\urpprot.exe" -noscan
StartupFolder: c:\docume~1\brian\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\imagem~1.lnk - c:\program files\pixela\imagemixer 3 se ver.4.5\transfer utility\CameraMonitor.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\smartb~1.lnk - c:\program files\smart technologies inc\smart board software\SMARTBoardTools.exe
IE: Inbox Search - tbr:iemenu
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1234169145515
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\inbox\ctbr.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {A794B62F-01A7-4F56-B1C7-4A568C1BECFF} - rundll32 nsfwj2.dll,laspi
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\brian\applic~1\mozilla\firefox\profiles\x3ydlwy6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15153&l=dis
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=UT2V5&o=15150&locale=en_US&q=
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\inbox\firefox\components\xcomm.dll
FF - component: c:\program files\inbox\firefox\components\xshared.dll
FF - component: c:\program files\inbox\firefox\components\xsupport.dll
FF - plugin: c:\documents and settings\brian\application data\move networks\plugins\npqmp071505000010.dll
FF - plugin: c:\documents and settings\brian\application data\move networks\plugins\npqmp071701000002.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\veoh networks\veoh\plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-1-31 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-3 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-1-3 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-1-3 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-1-3 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-3 297752]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [2009-9-24 72672]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;\??\c:\program files\vmlaunch\buddyvm.sys --> c:\program files\vmlaunch\BuddyVM.sys [?]
S2 gupdate1ca56ab8e11c5ea;Google Update Service (gupdate1ca56ab8e11c5ea);c:\program files\google\update\GoogleUpdate.exe [2009-10-26 133104]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2007-10-30 20160]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 1029456]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]
S3 SMART Web Server;SMART Web Server;c:\program files\smart technologies inc\smart board software\WebServer.exe [2007-11-2 767240]

=============== Created Last 30 ================

2010-04-13 20:58:37 71170 ----a-w- c:\docume~1\alluse~1\applic~1\8SOejo8n.exe
2010-04-13 19:34:08 98816 ----a-w- c:\windows\sed.exe
2010-04-13 19:34:08 77312 ----a-w- c:\windows\MBR.exe
2010-04-13 19:34:08 261632 ----a-w- c:\windows\PEV.exe
2010-04-13 19:34:08 161792 ----a-w- c:\windows\SWREG.exe
2010-04-13 19:07:09 176 ----a-w- c:\documents and settings\brian\defogger_reenable
2010-04-13 14:35:35 9 ----a-w- c:\windows\system32\Class14
2010-04-13 14:35:35 5 ----a-w- c:\windows\system32\Band4
2010-04-11 03:45:51 0 d-----w- c:\program files\iPod
2010-04-11 03:45:29 0 d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-09 06:37:04 0 d-----w- c:\program files\Inbox
2010-04-09 06:10:01 0 d-----w- c:\documents and settings\brian\Tracing
2010-04-09 05:52:50 0 d-----w- c:\program files\Microsoft
2010-04-09 05:52:22 0 d-----w- c:\program files\Windows Live SkyDrive
2010-04-09 05:44:25 0 d-----w- c:\program files\common files\Windows Live
2010-04-09 05:16:31 0 d-----w- c:\program files\Ask.com
2010-04-08 18:24:15 45568 ----a-w- c:\windows\system32\nsfwj2.dll
2010-04-08 18:24:15 3519 ----a-w- c:\windows\system32\krv
2010-04-07 00:28:20 0 d-----w- c:\program files\SEKILALA
2010-04-06 23:50:07 5350944 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-04-06 23:50:07 32032 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-04-06 23:50:07 32 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-04-06 23:50:07 32 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-04-06 23:49:46 1356 ----a-w- C:\rollback.ini
2010-04-06 23:45:41 0 d-----w- c:\docume~1\alluse~1\applic~1\RegCure
2010-04-06 23:31:10 0 d-----w- c:\program files\common files\ParetoLogic
2010-04-06 23:31:10 0 d-----w- c:\docume~1\alluse~1\applic~1\ParetoLogic
2010-04-06 22:52:14 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-04-06 22:52:14 0 d-----w- c:\docume~1\brian\applic~1\GetRightToGo
2010-04-06 21:21:06 0 d-----w- c:\program files\DAEMON Tools Lite
2010-04-06 11:57:31 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-06 11:56:46 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-06 01:30:39 0 d-----w- c:\docume~1\alluse~1\applic~1\Pixela
2010-04-06 01:27:52 0 d-----w- c:\program files\PIXELA
2010-04-05 10:18:44 112 ----a-w- c:\docume~1\alluse~1\applic~1\58q7uu.dat
2010-04-01 07:35:13 0 d-----w- c:\program files\Project64 1.6
2010-03-29 23:46:03 0 d-----w- c:\program files\DISCIPLINE
2010-03-29 19:44:50 0 d-----w- c:\program files\Kira Kira
2010-03-29 09:50:40 0 d-----w- c:\program files\directx
2010-03-29 09:37:58 479752 ----a-w- c:\windows\system32\XAudio2_0.dll
2010-03-29 09:35:24 0 d-----w- c:\windows\Logs
2010-03-29 06:41:27 754 ----a-w- c:\windows\WORDPAD.INI
2010-03-24 17:12:42 0 d-----w- c:\program files\Will
2010-03-18 22:30:29 0 d-----w- c:\program files\ZyX
2010-03-18 19:34:16 1089593 -c----w- c:\windows\system32\dllcache\ntprint.cat
2010-03-18 10:09:17 0 d-----w- c:\windows\system32\XPSViewer
2010-03-18 10:07:43 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-03-18 10:07:43 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-03-18 10:07:43 117760 ------w- c:\windows\system32\prntvpt.dll
2010-03-18 10:07:42 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-03-18 10:07:42 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-03-18 10:07:42 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-03-18 10:07:42 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-03-18 10:07:40 0 d-----w- C:\171eaa7061309267e3f8a3d06a4eb1fd
2010-03-18 10:04:14 0 d-----w- c:\program files\Essentials Codec Pack
2010-03-18 06:12:44 0 d-----w- c:\docume~1\brian\applic~1\Freedom Scientific
2010-03-18 06:11:23 0 d-----w- c:\docume~1\alluse~1\applic~1\Freedom Scientific
2010-03-18 06:11:14 0 d-----w- c:\program files\ssce
2010-03-18 06:00:18 256512 ----a-w- c:\windows\system32\dcmc0d0.dll
2010-03-18 06:00:13 0 d--h--w- c:\program files\Freedom Scientific Installation Information
2010-03-18 06:00:12 0 d-----w- c:\windows\system32\HJSMEM
2010-03-18 06:00:05 0 d-----w- c:\program files\Freedom Scientific
2010-03-18 05:54:10 0 d-----w- c:\program files\Bonjour
2010-03-18 05:42:49 0 d-----w- c:\docume~1\alluse~1\applic~1\Deskshare
2010-03-18 05:40:56 0 d-----w- c:\windows\XSxS
2010-03-18 05:40:56 0 d-----w- c:\program files\Xenocode
2010-03-18 05:39:58 0 d-----w- c:\program files\common files\DeskShare Shared
2010-03-18 05:39:57 0 d-----w- c:\program files\Deskshare
2010-03-18 05:38:59 0 d-----w- c:\windows\speech
2010-03-18 05:38:42 0 d-----w- c:\program files\ATTNaturalVoices
2010-03-18 04:53:42 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-03-18 04:53:42 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-03-17 09:30:12 301 ----a-w- c:\windows\ACTIVEJP.INI
2010-03-17 09:29:52 0 d-----w- c:\program files\BBLACK
2010-03-16 09:33:13 82172 -c--a-w- c:\windows\system32\dllcache\bopomofo.nls
2010-03-16 08:38:21 86016 ----a-w- c:\windows\unvise32.exe
2010-03-16 08:34:43 0 d-----w- c:\program files\Yin-Yang
2010-03-16 08:00:10 0 d-----w- c:\program files\Amorous Professor Cherry
2010-03-16 07:37:15 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-16 07:36:21 0 d-----w- c:\docume~1\brian\applic~1\DAEMON Tools Lite
2010-03-16 07:36:17 0 d-----w- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite

==================== Find3M ====================

2010-04-13 05:29:00 36352 ----a-w- c:\windows\system32\drivers\disk.sys
2010-04-13 00:34:16 96512 ------w- c:\windows\system32\drivers\atapi.sys
2010-04-12 21:20:03 41472 ----a-w- c:\windows\fonts\N2BMLre6S.com
2010-04-06 22:53:43 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-04-03 03:48:20 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
2010-03-30 07:46:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 07:45:52 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-18 06:25:31 2000000 ----atw- c:\windows\system32\HJSMEM.DAT
2010-02-25 06:24:37 916480 ------w- c:\windows\system32\wininet.dll
2010-02-12 18:46:14 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46:14 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-02-04 17:01:14 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 17:01:14 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 17:01:14 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 17:01:14 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-01-27 08:08:58 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2008-09-18 18:40:45 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090120080908\index.dat
2008-09-18 19:11:29 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091820080919\index.dat

============= FINISH: 20:42:52.73 ===============

Blade81 · Apr 14, 2010

Hi again,

Uninstall Ask Toolbar if not installed on purpose.

Are you familiar with these folders:
c:\program files\DISCIPLINE
c:\program files\Kira Kira

Upload c:\documents and settings\all users\application data\8SOejo8n.exe file to http://www.virustotal.com and post back the results.

Open notepad and copy/paste the text in the quotebox below into it:

Code:

DDS::
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: {F4F5B58A-D3A6-4F85-B3EF-5642E8937E6F} - No File
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No File
Folder::
c:\program files\SEKILALA
File::
c:\windows\system32\nsfwj2.dll
c:\windows\system32\krv
FileLook::
c:\docume~1\alluse~1\applic~1\58q7uu.dat
TDL::
C:\WINDOWS\system32\drivers\disk.sys
RenV::
c:\program files\Adobe\Reader 9.0\Reader\Reader_sl .exe
c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier .exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\DAEMON Tools Lite\DTLite .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\QuickTime\QTTask .exe
c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer .exe
c:\program files\Windows Live\Messenger\msnmsgr     .exe
c:\program files\Windows Live\Messenger\msnmsgr    .exe
c:\program files\Windows Live\Messenger\msnmsgr   .exe
c:\program files\Windows Live\Messenger\msnmsgr  .exe
c:\program files\Windows Live\Messenger\msnmsgr .exe
c:\windows\ime\imjp8_1\IMJPMIG .exe
c:\windows\ime\imkr6_1\IMEKRMIG .exe
Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Your Protection"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A794B62F-01A7-4F56-B1C7-4A568C1BECFF}]

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows, disable protection and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.

Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

dying of frustration · Apr 14, 2010

Ok, I got rid of the ask toolbar. And as for the two programs, I do know that my brother asked me if he could install them onto my computer, so i know that they are legitimate programs. Also, here is the results for virustotal.com scan.

I will have the rest in the next post.

File E01y5cgm.exe00 received on 2010.04.14 01:33:31 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.04.14 Trojan.Crypt!IK
AhnLab-V3 5.0.0.2 2010.04.13 -
AntiVir 7.10.6.69 2010.04.13 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.04.13 -
Authentium 5.2.0.5 2010.04.14 -
Avast 4.8.1351.0 2010.04.13 -
Avast5 5.0.332.0 2010.04.13 -
AVG 9.0.0.787 2010.04.14 Generic17.AYMR
BitDefender 7.2 2010.04.14 -
CAT-QuickHeal None 2010.04.13 -
ClamAV 0.96.0.3-git 2010.04.13 -
Comodo 4592 2010.04.14 -
DrWeb 5.0.2.03300 2010.04.14 -
eSafe 7.0.17.0 2010.04.13 -
eTrust-Vet 35.2.7423 2010.04.13 -
F-Prot 4.5.1.85 2010.04.13 -
F-Secure 9.0.15370.0 2010.04.14 -
Fortinet 4.0.14.0 2010.04.12 -
GData 19 2010.04.14 -
Ikarus T3.1.1.80.0 2010.04.14 Trojan.Crypt
Jiangmin 13.0.900 2010.04.13 -
Kaspersky 7.0.0.125 2010.04.14 -
McAfee 5.400.0.1158 2010.04.14 -
McAfee-GW-Edition 6.8.5 2010.04.13 Trojan.Crypt.ZPACK.Gen
Microsoft 1.5605 2010.04.14 -
NOD32 5026 2010.04.13 a variant of Win32/Kryptik.DPG
Norman 6.04.11 2010.04.13 -
nProtect 2009.1.8.0 2010.04.06 -
Panda 10.0.2.7 2010.04.13 -
PCTools 7.0.3.5 2010.04.14 -
Prevx 3.0 2010.04.14 High Risk Cloaked Malware
Rising 22.43.01.01 2010.04.13 -
Sophos 4.52.0 2010.04.14 Sus/UnkPack-C
Sunbelt 6173 2010.04.14 -
Symantec 20091.2.0.41 2010.04.14 -
TheHacker 6.5.2.0.260 2010.04.13 -
TrendMicro 9.120.0.1004 2010.04.13 -
VBA32 3.12.12.4 2010.04.09 -
ViRobot 2010.4.13.2274 2010.04.13 -
VirusBuster 5.0.27.0 2010.04.13 -
Additional information
File size: 71170 bytes
MD5 : 08a4615030a19708fc04e4f86d95b367
SHA1 : db6702050ee64da6b69537f88a096b8b2e5a40bf
SHA256: 7b0c0286043beda680d90955c9ffadf835c57b35338537a64f138cf5cc9a171f
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x40F0 timedatestamp.....: 0x4BC42225 (Tue Apr 13 09:49:57 2010) machinetype.......: 0x14C (Intel I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x3300 0x3400 5.84 fbf1720e09ca9da91a4520adb6a39ec2 .rdata 0x5000 0x511 0x600 4.45 fe7555cbf2f0d670fba40ecbbe4e44c4 .data 0x6000 0xD748 0xD600 7.96 c4bca389a7a0748956613e92e12eff69 .rsrc 0x14000 0x10 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b ( 3 imports ) > gdi32.dll: TextOutA, SetGraphicsMode, GetBkColor, CreateSolidBrush, SetBitmapBits, ResizePalette, GetObjectType, UpdateColors > kernel32.dll: GetACP, HeapAlloc, GetProcessHeap, GetCurrentProcess, GetProcAddress, GetModuleHandleA, CreateThread, GetCurrentThread, InterlockedIncrement, GetTickCount, InterlockedDecrement, QueryPerformanceCounter, InterlockedExchange, GetCurrentThreadId, InterlockedExchangeAdd, ExitProcess > user32.dll: TranslateMessage, GetMessageA, CreateWindowExA, RegisterClassExA, DispatchMessageA, DestroyWindow, DefWindowProcA, FindWindowA, FindWindowExA, GetCursor, GetActiveWindow, GetDlgItem, GetCapture ( 1 exports ) > _Aje20A@@YAHHPADHHH@Z, _Aje22C@@YAHHPADHHH@Z, _Aje25F@@YAHHPADHHH@Z, _Aje26G@@YAHHPADHHH@Z, _Aje29J@@YAHHPADHHH@Z
TrID : File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 1536:/n8JhdYDHcaFDkJaYcgmuDqDObALcJos+/A8kiSe4+lP8e2d1svKG4+:fpFDkJaYouD6ObALb0rMPksyGd
sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned 
Prevx Info: <a href="http://info.prevx.com/aboutprogramtext.asp?PX5=0A9B1F7602E5BC6E16830133D5A0A30099BF335F" target="_blank">http://info.prevx.com/aboutprogramtext.asp?PX5=0A9B1F7602E5BC6E16830133D5A0A30099BF335F</a>
PEiD : -
RDS : NSRL Reference Data Set -

I'm hoping that was what you were looking for. If not, let me know.

dying of frustration · Apr 14, 2010

And here is the ComboFix log.

ComboFix 10-04-13.02 - Brian 04/14/2010 0:42.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.577 [GMT -7:00]
Running from: c:\documents and settings\Brian\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Brian\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\system32\krv"
"c:\windows\system32\nsfwj2.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\8SOejo8n.exe
c:\program files\SEKILALA
c:\program files\SEKILALA\KONYAUS\DATA
c:\program files\SEKILALA\KONYAUS\GGD
c:\program files\SEKILALA\KONYAUS\ISF
c:\program files\SEKILALA\KONYAUS\KONYAUS.CNT
c:\program files\SEKILALA\KONYAUS\KONYAUS.EXE
c:\program files\SEKILALA\KONYAUS\KONYAUS.HLP
c:\program files\SEKILALA\KONYAUS\KONYAUS.SUF
c:\program files\SEKILALA\KONYAUS\MIDI
c:\program files\SEKILALA\KONYAUS\SE
c:\program files\SEKILALA\KONYAUS\VOICE
c:\program files\SEKILALA\KONYAUS\WMSC
c:\windows\system32\krv
c:\windows\system32\nsfwj2.dll

Infected copy of c:\windows\system32\DRIVERS\disk.sys was found and disinfected
Restored copy from - Kitty ate it

.
((((((((((((((((((((((((( Files Created from 2010-03-14 to 2010-04-14 )))))))))))))))))))))))))))))))
.

2010-04-13 06:00 . 2010-04-14 07:07 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\AskToolbar
2010-04-13 05:59 . 2010-04-13 05:59 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Conduit
2010-04-13 05:59 . 2010-04-13 06:00 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Online_Sharing
2010-04-12 21:20 . 2010-04-12 21:20 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-04-11 03:45 . 2010-04-11 03:45 -------- d-----w- c:\program files\iPod
2010-04-11 03:45 . 2010-04-11 03:46 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-11 03:42 . 2010-04-11 03:42 -------- d-----w- c:\program files\Apple Software Update
2010-04-09 06:37 . 2010-04-14 07:20 -------- d-----w- c:\program files\Inbox
2010-04-09 06:10 . 2010-04-14 04:11 -------- d-----w- c:\documents and settings\Brian\Tracing
2010-04-09 05:59 . 2010-04-09 05:59 -------- d-----w- c:\program files\Microsoft Sync Framework
2010-04-09 05:52 . 2010-04-09 05:52 -------- d-----w- c:\program files\Microsoft
2010-04-09 05:52 . 2010-04-09 05:52 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-04-09 05:44 . 2010-04-09 05:44 -------- d-----w- c:\program files\Common Files\Windows Live
2010-04-08 16:16 . 2010-04-08 16:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-04-08 16:14 . 2010-04-08 16:14 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-04-06 23:50 . 2010-04-07 22:02 32032 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-04-06 23:50 . 2010-04-07 22:01 5350944 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-04-06 23:45 . 2010-04-07 22:12 -------- d-----w- c:\documents and settings\All Users\Application Data\RegCure
2010-04-06 23:31 . 2010-04-07 21:49 -------- d-----w- c:\program files\Common Files\ParetoLogic
2010-04-06 23:31 . 2010-04-07 21:49 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-04-06 23:30 . 2010-04-06 23:30 -------- d-----w- c:\documents and settings\Brian\Local Settings\Application Data\Downloaded Installations
2010-04-06 22:52 . 2010-04-06 22:54 -------- d-----w- c:\documents and settings\Brian\Application Data\GetRightToGo
2010-04-06 21:21 . 2010-04-14 07:42 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-04-06 11:57 . 2010-04-06 11:57 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-06 11:56 . 2010-04-06 11:57 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-06 09:00 . 2010-04-06 09:00 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-04-06 04:16 . 2010-04-08 15:39 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-06 01:30 . 2010-04-07 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Pixela
2010-04-06 01:27 . 2010-04-06 01:28 -------- d-----w- c:\program files\PIXELA
2010-04-05 10:20 . 2010-04-05 10:20 -------- d-sh--w- c:\documents and settings\NetworkService\PrivacIE
2010-04-01 07:35 . 2010-04-01 07:59 -------- d-----w- c:\program files\Project64 1.6
2010-03-31 18:28 . 2010-03-31 18:28 50192 ----a-w- c:\documents and settings\Others\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-31 17:52 . 2010-03-31 17:52 -------- d-----w- c:\documents and settings\Others\Local Settings\Application Data\Mozilla
2010-03-31 17:32 . 2010-03-31 17:32 -------- d-----w- c:\documents and settings\Others\Application Data\SMART Technologies Inc
2010-03-31 17:32 . 2010-03-31 17:32 -------- d-----w- c:\documents and settings\Others\Local Settings\Application Data\Apple Computer
2010-03-31 17:32 . 2010-03-31 17:32 -------- d-----w- c:\documents and settings\Others\Local Settings\Application Data\SupportSoft
2010-03-31 17:12 . 2010-03-31 17:12 -------- d-----w- c:\documents and settings\Guest\Application Data\SMART Technologies Inc
2010-03-29 23:46 . 2010-04-12 20:22 -------- d-----w- c:\program files\DISCIPLINE
2010-03-29 19:44 . 2010-04-12 20:20 -------- d-----w- c:\program files\Kira Kira
2010-03-29 09:50 . 2010-03-29 09:50 -------- d-----w- c:\program files\directx
2010-03-29 09:37 . 2008-03-05 23:03 479752 ----a-w- c:\windows\system32\XAudio2_0.dll
2010-03-29 09:35 . 2010-03-29 09:35 -------- d-----w- c:\windows\Logs
2010-03-24 17:12 . 2010-04-02 19:59 -------- d-----w- c:\program files\Will
2010-03-18 22:30 . 2010-03-29 20:49 -------- d-----w- c:\program files\ZyX
2010-03-18 10:09 . 2010-03-18 10:09 -------- d-----w- c:\windows\system32\XPSViewer
2010-03-18 10:09 . 2010-03-18 10:09 -------- d-----w- c:\program files\MSBuild
2010-03-18 10:08 . 2010-03-18 10:08 -------- d-----w- c:\program files\Reference Assemblies
2010-03-18 10:08 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-03-18 10:07 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-03-18 10:07 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-03-18 10:07 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-03-18 10:07 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-03-18 10:07 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-03-18 10:07 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-03-18 10:07 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-03-18 10:07 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-03-18 10:07 . 2010-03-18 10:08 -------- d-----w- C:\171eaa7061309267e3f8a3d06a4eb1fd
2010-03-18 10:04 . 2010-03-18 10:04 -------- d-----w- c:\program files\Essentials Codec Pack
2010-03-18 06:12 . 2010-03-18 06:12 -------- d-----w- c:\documents and settings\Brian\Application Data\Freedom Scientific
2010-03-18 06:11 . 2010-03-18 06:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Freedom Scientific
2010-03-18 06:11 . 2010-03-18 06:11 -------- d-----w- c:\program files\ssce
2010-03-18 06:00 . 2006-02-10 04:58 256512 ----a-w- c:\windows\system32\dcmc0d0.dll
2010-03-18 06:00 . 2010-03-18 06:11 -------- d--h--w- c:\program files\Freedom Scientific Installation Information
2010-03-18 06:00 . 2010-03-18 06:00 -------- d-----w- c:\windows\system32\HJSMEM
2010-03-18 06:00 . 2010-03-18 06:11 -------- d-----w- c:\program files\Freedom Scientific
2010-03-18 05:54 . 2010-03-18 05:54 -------- d-----w- c:\program files\Bonjour
2010-03-18 05:42 . 2010-03-18 05:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Deskshare
2010-03-18 05:40 . 2010-03-18 05:40 -------- d-----w- c:\windows\XSxS
2010-03-18 05:40 . 2010-03-18 05:40 -------- d-----w- c:\program files\Xenocode
2010-03-18 05:40 . 2010-03-18 05:40 -------- d-----w- c:\documents and settings\Brian\Local Settings\Application Data\Xenocode
2010-03-18 05:39 . 2010-03-18 05:39 -------- d-----w- c:\program files\Common Files\DeskShare Shared
2010-03-18 05:39 . 2010-03-18 05:39 -------- d-----w- c:\program files\Deskshare
2010-03-18 05:38 . 2010-03-18 05:39 -------- d-----w- c:\windows\speech
2010-03-18 05:38 . 2010-03-18 05:38 -------- d-----w- c:\program files\ATTNaturalVoices
2010-03-17 09:29 . 2010-03-17 09:34 -------- d-----w- c:\program files\BBLACK
2010-03-16 09:33 . 2001-08-23 09:00 6144 -c--a-w- c:\windows\system32\dllcache\kbd101a.dll
2010-03-16 08:38 . 1999-12-17 16:13 86016 ----a-w- c:\windows\unvise32.exe
2010-03-16 08:34 . 2010-04-12 20:20 -------- d-----w- c:\program files\Yin-Yang
2010-03-16 08:00 . 2010-04-12 20:21 -------- d-----w- c:\program files\Amorous Professor Cherry
2010-03-16 07:37 . 2010-03-16 07:37 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-16 07:36 . 2010-03-16 07:58 -------- d-----w- c:\documents and settings\Brian\Application Data\DAEMON Tools Lite
2010-03-16 07:36 . 2010-03-16 07:36 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-14 07:56 . 2010-03-06 19:54 -------- d-----w- c:\program files\iTunes
2010-04-14 07:56 . 2009-12-12 19:51 -------- d-----w- c:\program files\QuickTime
2010-04-14 04:58 . 2010-04-05 10:18 112 ----a-w- c:\documents and settings\All Users\Application Data\58q7uu.dat
2010-04-14 00:40 . 2007-12-06 23:56 -------- d-----w- c:\program files\dl_Cats
2010-04-13 19:56 . 2007-10-30 21:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-13 05:29 . 2004-08-10 12:00 36352 ----a-w- c:\windows\system32\drivers\disk.sys
2010-04-13 00:34 . 2004-08-10 12:00 96512 ------w- c:\windows\system32\drivers\atapi.sys
2010-04-12 21:20 . 2010-04-12 21:20 41472 ----a-w- c:\windows\Fonts\N2BMLre6S.com
2010-04-11 03:45 . 2008-01-05 21:26 -------- d-----w- c:\program files\Common Files\Apple
2010-04-09 06:01 . 2007-12-07 00:44 50776 ----a-w- c:\documents and settings\Brian\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-09 06:00 . 2008-03-03 19:41 -------- d-----w- c:\program files\Windows Live
2010-04-09 05:59 . 2007-12-10 01:52 -------- d-----w- c:\program files\Windows Live Toolbar
2010-04-08 15:50 . 2008-08-20 00:19 -------- d-----w- c:\program files\AVG
2010-04-08 15:50 . 2008-08-20 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2010-04-07 21:55 . 2009-06-25 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-04-06 23:59 . 2010-04-06 23:59 125952 ----a-w- c:\documents and settings\All Users\Application Data\ParetoLogic\UUS2\Temp\Update.exe
2010-04-06 23:50 . 2010-04-06 23:50 32 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-04-06 23:50 . 2010-04-06 23:50 32 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-04-06 23:14 . 2010-04-06 22:49 79488 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\jre1.6.0_19\gtapi.dll
2010-04-06 23:14 . 2010-04-06 22:49 152576 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\jre1.6.0_19\lzma.dll
2010-04-06 22:53 . 2008-12-15 17:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-04-06 22:43 . 2008-03-05 17:38 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-06 02:05 . 2007-10-30 20:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-06 01:19 . 2009-01-03 20:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-06 01:19 . 2009-01-15 06:40 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-05 09:52 . 2008-11-11 22:35 1 ----a-w- c:\documents and settings\Brian\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-03 03:48 . 2007-12-20 09:47 56 --sh--r- c:\windows\system32\0E64EFB052.sys
2010-04-03 03:48 . 2007-12-20 09:47 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
2010-04-01 04:14 . 2010-04-01 04:14 61440 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-72781112-n\decora-sse.dll
2010-04-01 04:14 . 2010-04-01 04:14 503808 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-70ee7950-n\msvcp71.dll
2010-04-01 04:14 . 2010-04-01 04:14 499712 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-70ee7950-n\jmc.dll
2010-04-01 04:14 . 2010-04-01 04:14 348160 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-70ee7950-n\msvcr71.dll
2010-04-01 04:14 . 2010-04-01 04:14 12800 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-72781112-n\decora-d3d.dll
2010-03-30 07:46 . 2009-01-03 20:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 07:45 . 2009-01-03 20:22 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-29 07:08 . 2008-02-07 18:42 -------- d-----w- c:\documents and settings\Brian\Application Data\Jasc Software Inc
2010-03-26 08:48 . 2010-03-26 08:48 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-03-24 18:17 . 2010-03-24 08:04 952768 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AdobeARM.exe
2010-03-24 18:17 . 2010-03-24 08:04 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AdobeExtractFiles.dll
2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\ReaderUpdater.exe
2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AcrobatUpdater.exe
2010-03-18 22:15 . 2008-03-25 03:09 -------- d-----w- c:\program files\CCleaner
2010-03-18 22:01 . 2008-05-22 16:37 -------- d-----w- c:\documents and settings\Brian\Application Data\Uniblue
2010-03-18 20:43 . 2009-01-10 08:32 -------- d-----w- c:\program files\VideoLAN
2010-03-18 06:25 . 2008-04-23 18:40 2000000 ----atw- c:\windows\system32\HJSMEM.DAT
2010-03-18 05:55 . 2009-09-06 23:53 -------- d-----w- c:\program files\Safari
2010-03-16 09:59 . 2010-03-16 09:59 29926 ----a-r- c:\documents and settings\Brian\Application Data\Microsoft\Installer\{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_18be6784.exe
2010-03-16 09:59 . 2010-03-16 09:59 29422 ----a-r- c:\documents and settings\Brian\Application Data\Microsoft\Installer\{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_294823.exe
2010-03-11 10:03 . 2008-10-19 07:58 -------- d-----w- c:\program files\ffdshow
2010-03-11 10:03 . 2008-05-22 16:19 -------- d-----w- c:\program files\Free Offers from Freeze.com
2010-03-10 21:19 . 2007-12-07 05:27 -------- d-----w- c:\documents and settings\All Users\Application Data\SupportSoft
2010-03-05 11:47 . 2008-10-10 19:00 -------- d-----w- c:\documents and settings\Brian\Application Data\Move Networks
2010-03-04 11:45 . 2007-12-09 20:35 -------- d-----w- c:\program files\DivX
2010-03-04 11:43 . 2009-10-27 02:16 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-03-04 11:00 . 2010-03-04 11:00 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-02 05:33 . 2009-06-23 04:32 315736 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-03-02 05:33 . 2009-06-23 04:32 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2010-03-02 05:33 . 2009-06-23 04:32 173408 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-03-02 05:33 . 2009-06-02 04:33 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-02 05:33 . 2009-06-23 04:32 350544 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-03-02 05:33 . 2009-06-23 04:32 303456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-03-02 05:33 . 2009-06-23 04:32 1630560 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-02 05:33 . 2009-06-02 04:33 89952 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-03-02 05:33 . 2009-06-02 04:32 254832 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-03-02 05:32 . 2009-06-23 04:32 671592 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-03-02 05:32 . 2009-06-02 04:32 45408 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-03-02 05:32 . 2009-09-29 04:32 3701760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-03-02 05:32 . 2009-06-23 04:32 566648 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-03-02 05:32 . 2009-06-23 04:32 567144 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-03-02 05:32 . 2009-06-23 04:32 2357064 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-03-02 05:32 . 2009-06-23 04:32 524632 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-03-02 05:32 . 2009-06-23 04:32 1029456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-03-01 05:41 . 2010-03-01 05:41 -------- d-----w- c:\program files\NaturalSoft
2010-02-25 06:24 . 2004-08-10 12:00 916480 ------w- c:\windows\system32\wininet.dll
2010-02-23 13:45 . 2010-02-22 22:10 7 ----a-w- c:\windows\sbacknt.bin
2010-02-23 06:28 . 2010-02-23 05:58 -------- d-----w- c:\documents and settings\Brian\Application Data\Toolbar4
2010-02-23 05:40 . 2010-02-23 05:40 -------- d-----w- c:\program files\Conduit
2010-02-23 05:40 . 2010-02-23 05:40 -------- d-----w- c:\program files\Online_Sharing
2010-02-17 00:11 . 2007-10-30 21:09 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-14 09:36 . 2010-02-14 09:36 -------- d-----w- c:\program files\RADVideo
2010-02-14 09:28 . 2010-02-14 09:28 -------- d-----w- c:\program files\Common Files\Common Share
2010-02-12 18:46 . 2010-02-12 18:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46 . 2010-02-12 18:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-02-04 17:01 . 2010-03-29 09:38 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 17:01 . 2010-03-29 09:38 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 17:01 . 2010-03-29 09:38 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 17:01 . 2010-03-29 09:38 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-01-27 08:08 . 2008-10-19 07:58 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-01-27 05:38 . 2010-01-27 05:38 348160 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4f12d232-n\msvcr71.dll
2010-01-27 05:38 . 2010-01-27 05:38 61440 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-126fe1bb-n\decora-sse.dll
2010-01-27 05:38 . 2010-01-27 05:38 503808 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4f12d232-n\msvcp71.dll
2010-01-27 05:38 . 2010-01-27 05:38 499712 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4f12d232-n\jmc.dll
2010-01-27 05:38 . 2010-01-27 05:38 12800 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-126fe1bb-n\decora-d3d.dll
.

Code:

<pre>
c:\program files\Adobe\Reader 9.0\Reader\Reader_sl .exe
c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\QuickTime\qttask .exe
c:\windows\ime\imjp8_1\IMJPMIG .exe
c:\windows\ime\imkr6_1\IMEKRMIG .exe
</pre>

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

--- c:\docume~1\alluse~1\applic~1\58q7uu.dat ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 112
Created time: 2010-04-05 10:18
Modified time: 2010-04-14 04:58
MD5: E87DF3C00ECAF332FD76B2BF7A014897
SHA1: B03862C283902714608B2FC32BEE40B82BC137C0

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8567a644-e36c-470c-86cf-9c5b4f37db81}]
2009-12-31 19:53 2349080 ----a-w- c:\program files\Online_Sharing\tbOnli.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 21:03 1230080 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
"{8567a644-e36c-470c-86cf-9c5b4f37db81}"= "c:\program files\Online_Sharing\tbOnli.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CLASSES_ROOT\clsid\{8567a644-e36c-470c-86cf-9c5b4f37db81}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{8567A644-E36C-470C-86CF-9C5B4F37DB81}"= "c:\program files\Online_Sharing\tbOnli.dll" [2009-12-31 2349080]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{8567a644-e36c-470c-86cf-9c5b4f37db81}]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr .exe" [N/A]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2010-01-26 2633976]
"LxrAutorun"="c:\documents and settings\Brian\Local Settings\Application Data\Lexar Media\LxrAutorun.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QUICKCARE"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-08 192512]
"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-06-07 69632]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-14 41476]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-14 41476]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-14 41476]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2001-08-23 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-04-14 41476]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-04-14 41476]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-14 41476]

c:\documents and settings\Brian\Start Menu\Programs\Startup\
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-6-24 803176]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
ImageMixer 3 SE Camera Monitor Ver.4.5.lnk - c:\program files\PIXELA\ImageMixer 3 SE Ver.4.5\Transfer Utility\CameraMonitor.exe [2010-4-5 406896]
SMART Board Tools.lnk - c:\program files\SMART Technologies Inc\SMART Board Software\SMARTBoardTools.exe [2007-11-2 4519176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-16 19:50 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2006-02-10 05:05 344064 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlccmon.exe]
2005-07-22 19:03 425984 ----a-w- c:\program files\Dell Photo AIO Printer 924\dlccmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 21:56 64512 ----a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-06-16 14:03 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-06-16 14:03 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-04-14 07:56 41476 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-12 22:15 41484 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QUICKCARE]
2006-11-08 04:07 192512 ----a-w- c:\program files\Qwest\QuickCare\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-04-14 07:56 41476 ----a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2005-03-23 01:20 339968 ----a-w- c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 23:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-04-14 07:56 41476 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
2008-08-28 17:18 3660848 ----a-w- c:\program files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"SPF4"=2 (0x2)
"IDriverT"=3 (0x3)
"gusvc"=3 (0x3)
"dlcc_device"=3 (0x3)
"BOCore"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\WINDOWS\\system32\\dlcccoms.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Guild Wars\\Gw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1/31/2009 10:32 PM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/3/2009 12:41 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/3/2009 12:41 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [1/3/2009 12:41 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/3/2009 12:41 PM 297752]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [9/24/2009 8:15 PM 72672]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;\??\c:\program files\VMLaunch\BuddyVM.sys --> c:\program files\VMLaunch\BuddyVM.sys [?]
S2 gupdate1ca56ab8e11c5ea;Google Update Service (gupdate1ca56ab8e11c5ea);c:\program files\Google\Update\GoogleUpdate.exe [10/26/2009 7:16 PM 133104]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [10/30/2007 12:56 PM 20160]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 2:34 PM 1029456]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 5:20 AM 12648]
S3 SMART Web Server;SMART Web Server;c:\program files\SMART Technologies Inc\SMART Board Software\WebServer.exe [11/2/2007 6:48 AM 767240]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/16/2010 12:37 AM 691696]
.
Contents of the 'Scheduled Tasks' folder

2010-04-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 05:32]

2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 18:50]

2010-04-14 c:\windows\Tasks\At1.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At10.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At11.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At12.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-12 c:\windows\Tasks\At13.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At14.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At15.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At16.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At17.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At18.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At19.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At2.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At20.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At21.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At22.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At23.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At24.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At3.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At4.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At49.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At5.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At50.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At51.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At52.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At53.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At54.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At55.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At56.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At57.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At58.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At59.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At6.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At60.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-12 c:\windows\Tasks\At61.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At62.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At63.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At64.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At65.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At66.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At67.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At68.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At69.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At7.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At70.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At71.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\At72.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At8.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-13 c:\windows\Tasks\At9.job
- c:\windows\Fonts\N2BMLre6S.com [2010-04-12 21:20]

2010-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-27 02:16]

2010-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-27 02:16]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.live.com/
mStart Page = hxxp://www.bigseekpro.com/webscout/{213687C0-A8F8-4791-AD1C-94B40145C34C}
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Inbox Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Inbox\ctbr.dll
FF - ProfilePath - c:\documents and settings\Brian\Application Data\Mozilla\Firefox\Profiles\x3ydlwy6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15153&l=dis
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Inbox\firefox\components\xcomm.dll
FF - component: c:\program files\Inbox\firefox\components\xshared.dll
FF - component: c:\program files\Inbox\firefox\components\xsupport.dll
FF - plugin: c:\documents and settings\Brian\Application Data\Move Networks\plugins\npqmp071505000010.dll
FF - plugin: c:\documents and settings\Brian\Application Data\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-14 00:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5d,1a,f6,c6,ac,aa,3a,48,98,4a,c9,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5d,1a,f6,c6,ac,aa,3a,48,98,4a,c9,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2672)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\LxrSII1s.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\program files\SMART Technologies Inc\SMART Board Software\Aware.exe
c:\program files\SMART Technologies Inc\SMART Board Software\Marker.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-04-14 01:00:15 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-14 08:00
ComboFix2.txt 2010-04-13 19:56

Pre-Run: 21,430,013,952 bytes free
Post-Run: 21,405,990,912 bytes free

- - End Of File - - F28CBDC6C9E74B1E8990F3DABE7B2DB0

Blade81 · Apr 14, 2010

Hi,

Upload these files to http://www.virustotal.com and post back the results (notice white spaces in front of .exe):
c:\program files\Adobe\Reader 9.0\Reader\Reader_sl .exe
c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier .exe

Open notepad and copy/paste the text in the quotebox below into it:

Code:

File::
c:\docume~1\alluse~1\applic~1\58q7uu.dat
c:\windows\Fonts\N2BMLre6S.com
RenV::
c:\program files\Adobe\Reader 9.0\Reader\Reader_sl .exe
c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\QuickTime\qttask .exe
c:\windows\ime\imjp8_1\IMJPMIG .exe
c:\windows\ime\imkr6_1\IMEKRMIG .exe
AtJob::

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.

Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

dying of frustration · Apr 14, 2010

Does that mean that you want me to skip posting the kaspersky scan results and dds log that you asked for in your previous post, or do you want those as well?

Blade81 · Apr 14, 2010

Hi,

Those are included in my latest instruction set.

dying of frustration · Apr 14, 2010

Ok here's the first half of your requests.

This is Reader_sl. exe

File D6C4746270197E548B03001BDF343800A27ABB3A.exe received on 2010.04.07 15:02:43 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.04.07 -
AhnLab-V3 5.0.0.2 2010.04.07 -
AntiVir 7.10.6.40 2010.04.07 -
Antiy-AVL 2.0.3.7 2010.04.07 -
Authentium 5.2.0.5 2010.04.07 -
Avast 4.8.1351.0 2010.04.07 -
Avast5 5.0.332.0 2010.04.07 -
AVG 9.0.0.787 2010.04.07 -
BitDefender 7.2 2010.04.07 -
CAT-QuickHeal 10.00 2010.04.07 -
ClamAV 0.96.0.3-git 2010.04.07 -
Comodo 4530 2010.04.07 -
DrWeb 5.0.2.03300 2010.04.07 -
eSafe 7.0.17.0 2010.04.07 -
eTrust-Vet 35.2.7412 2010.04.07 -
F-Prot 4.5.1.85 2010.04.07 -
F-Secure 9.0.15370.0 2010.04.07 -
Fortinet 4.0.14.0 2010.04.07 -
GData 19 2010.04.07 -
Ikarus T3.1.1.80.0 2010.04.07 -
Jiangmin 13.0.900 2010.04.07 -
Kaspersky 7.0.0.125 2010.04.07 -
McAfee-GW-Edition 6.8.5 2010.04.07 -
Microsoft 1.5605 2010.04.07 -
NOD32 5007 2010.04.07 -
Norman 6.04.11 2010.04.07 -
nProtect 2009.1.8.0 2010.04.06 -
Panda 10.0.2.2 2010.04.06 -
PCTools 7.0.3.5 2010.04.07 -
Prevx 3.0 2010.04.07 -
Rising 22.42.02.03 2010.04.07 -
Sophos 4.52.0 2010.04.07 -
Sunbelt 6147 2010.04.07 -
Symantec 20091.2.0.41 2010.04.07 -
TheHacker 6.5.2.0.256 2010.04.07 -
TrendMicro 9.120.0.1004 2010.04.07 -
VBA32 3.12.12.4 2010.04.05 -
ViRobot 2010.4.7.2265 2010.04.07 -
VirusBuster 5.0.27.0 2010.04.07 -
Additional information
File size: 35696 bytes
MD5 : 33e5a8fc8eb0ee42478f8538d0215d8f
SHA1 : 59faa4839591b954fe58e5e4db744fecc00cae46
SHA256: 206aca11b99234a1d31c5dd8506d207b591883aaa5cfbbadac66a13a3f523881
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x3E34 timedatestamp.....: 0x4AC730B0 (Sat Oct 3 13:08:32 2009) machinetype.......: 0x14C (Intel I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x366C 0x3800 6.17 4368301dbc825ea4f61a42cec41ad14b .rdata 0x5000 0x2DD6 0x2E00 4.54 14d8058e0f0d26d49f97eeed439f6675 .data 0x8000 0x778 0x400 4.18 d2df7bde1bb0d703cb3266f1344bc9c8 .rsrc 0x9000 0x6FC 0x800 4.79 e4badf348626f068441546c588729d3d ( 6 imports ) > advapi32.dll: OpenSCManagerA, QueryServiceStatus, CloseServiceHandle, RegOpenKeyA, RegQueryValueExA, RegCloseKey, RegQueryValueA, OpenServiceA > kernel32.dll: CloseHandle, TerminateThread, CreateThread, InitializeCriticalSection, CreateEventA, GetSystemInfo, UnmapViewOfFile, CreateFileA, VirtualQueryEx, GetCurrentProcess, MapViewOfFile, CreateFileMappingA, GetFileAttributesA, FindClose, FindNextFileA, FindFirstFileA, ReadFile, DeleteCriticalSection, GetTempPathA, GetWindowsDirectoryA, GetSystemDirectoryA, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoA, InterlockedCompareExchange, Sleep, InterlockedExchange, GetSystemTimeAsFileTime, GetCurrentThread, GetModuleHandleA, GetModuleFileNameA, EnterCriticalSection, SetEvent, SetThreadPriority, LeaveCriticalSection, SetFilePointer, WaitForSingleObject > msvcp80.dll: _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBD@Z, __4_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV01@PBD@Z, _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, _erase@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@II@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@PBDI@Z, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@ABV01@@Z, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, _c_str@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEPBDXZ, __$_MDU_$char_traits@D@std@@V_$allocator@D@1@@std@@YA_NABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@0@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@PBD@Z > msvcr80.dll: _onexit, _decode_pointer, _invoke_watson, _controlfp_s, _lock, __dllonexit, strrchr, memset, malloc, __CxxFrameHandler3, __1exception@std@@UAE@XZ, __3@YAXPAX@Z, __0exception@std@@QAE@XZ, _invalid_parameter_noinfo, __2@YAPAXI@Z, _CxxThrowException, __0exception@std@@QAE@ABV01@@Z, ___V@YAXPAX@Z, strchr, free, _terminate@@YAXXZ, _amsg_exit, __getmainargs, _cexit, _exit, _XcptFilter, _ismbblead, exit, _acmdln, _initterm, _initterm_e, _configthreadlocale, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, _encode_pointer, __set_app_type, _crt_debugger_hook, __type_info_dtor_internal_method@type_info@@QAEXXZ, _except_handler4_common, _unlock > shell32.dll: SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc > user32.dll: GetMessageA, SetTimer, DispatchMessageA, TranslateMessage, KillTimer, DestroyWindow, UnregisterClassA, LoadIconA, LoadCursorA, RegisterClassExA, CreateWindowExA, DefWindowProcA, PostQuitMessage, FindWindowA ( 0 exports ) 
TrID : File type identification Win64 Executable Generic (80.9%) Win32 Executable Generic (8.0%) Win32 Dynamic Link Library (generic) (7.1%) Generic Win/DOS Executable (1.8%) DOS Executable Generic (1.8%)
ssdeep: 768:5Lnl2NrrNNEFtuEx+PVwdVr2K5uCvypDkmOe0WcL4IbqYMo:5Lny/HEvuE8VaFMOe0WclqDo
sigcheck: publisher....: Adobe Systems Incorporated copyright....: Copyright 1984-2009 Adobe Systems Incorporated and its licensors. All rights reserved. product......: Adobe Acrobat description..: Adobe Acrobat SpeedLauncher original name: AcroSpeedLaunch.exe internal name: n/a file version.: 9.2.0.124 comments.....: signers......: Adobe Systems, Incorporated VeriSign Class 3 Code Signing 2004 CA Class 3 Public Primary Certification Authority signing date.: 12:08 PM 10/3/2009 verified.....: - 
PEiD : -
RDS : NSRL Reference Data Set -

And Reader_sl.exe

File Reader_sl.exe received on 2010.04.14 15:36:43 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.04.14 -
AhnLab-V3 5.0.0.2 2010.04.13 -
AntiVir 7.10.6.76 2010.04.14 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.04.14 -
Authentium 5.2.0.5 2010.04.14 -
Avast 4.8.1351.0 2010.04.14 Win32:Rootkit-gen
Avast5 5.0.332.0 2010.04.14 Win32:Rootkit-gen
AVG 9.0.0.787 2010.04.14 Generic17.AYEN
BitDefender 7.2 2010.04.14 -
CAT-QuickHeal 10.00 2010.04.14 -
ClamAV 0.96.0.3-git 2010.04.14 -
Comodo 4596 2010.04.14 -
DrWeb 5.0.2.03300 2010.04.14 -
eSafe 7.0.17.0 2010.04.14 -
eTrust-Vet 35.2.7425 2010.04.14 -
F-Prot 4.5.1.85 2010.04.14 -
F-Secure 9.0.15370.0 2010.04.14 -
Fortinet 4.0.14.0 2010.04.12 -
GData 19 2010.04.14 Win32:Rootkit-gen
Ikarus T3.1.1.80.0 2010.04.14 -
Jiangmin 13.0.900 2010.04.13 -
Kaspersky 7.0.0.125 2010.04.14 -
McAfee 5.400.0.1158 2010.04.14 -
McAfee-GW-Edition 6.8.5 2010.04.14 Trojan.Crypt.ZPACK.Gen
Microsoft 1.5605 2010.04.14 Trojan:Win32/Meredrop
NOD32 5028 2010.04.14 a variant of Win32/Kryptik.DPG
Norman 6.04.11 2010.04.14 -
nProtect 2010-04-14.01 2010.04.14 -
Panda 10.0.2.7 2010.04.13 -
PCTools 7.0.3.5 2010.04.14 -
Prevx 3.0 2010.04.14 High Risk Cloaked Malware
Rising 22.43.02.04 2010.04.14 -
Sophos 4.52.0 2010.04.14 Sus/UnkPack-C
Sunbelt 6175 2010.04.14 Trojan.Win32.Meredrop
Symantec 20091.2.0.41 2010.04.14 -
TheHacker 6.5.2.0.261 2010.04.14 Trojan/Kryptik.dpg
TrendMicro 9.120.0.1004 2010.04.14 -
VBA32 3.12.12.4 2010.04.14 -
ViRobot 2010.4.14.2276 2010.04.14 -
VirusBuster 5.0.27.0 2010.04.14 -
Additional information
File size: 41476 bytes
MD5...: 620ce7ae0f04150afe16d9b110af381a
SHA1..: d6dc1e54c7a8611b9d3baa3699b1e1ab1abcda17
SHA256: d1e7d7b69d9809ff2248411bdf787c589ed0d80d8aff41d01c31a30ac49286a6
ssdeep: 768:a2uQDfqa83kfV2iY1XxtKaKWXwY8kK8dofILDFTS5bnrKUI5yddZ/uN:5qa8 0fViXxcaNXYJ8d/VTS5KUI0ddpS 
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x40f0 timedatestamp.....: 0x4bc1e49d (Sun Apr 11 15:02:53 2010) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x3300 0x3400 5.77 3ac5ef48a907e68d7b055933bce6f634 .rdata 0x5000 0x511 0x600 4.45 af0728b154525e2a3d9669ddae9e16bf .data 0x6000 0x63f0 0x6200 7.90 37019c768b21ef5911ffd32ccf2a3a89 .rsrc 0xd000 0x10 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b ( 3 imports ) > KERNEL32.dll: GetACP, HeapAlloc, GetProcessHeap, GetCurrentProcess, GetProcAddress, GetModuleHandleA, CreateThread, GetCurrentThread, InterlockedIncrement, GetTickCount, InterlockedDecrement, QueryPerformanceCounter, InterlockedExchange, GetCurrentThreadId, InterlockedExchangeAdd, ExitProcess > USER32.dll: TranslateMessage, GetMessageA, CreateWindowExA, RegisterClassExA, DispatchMessageA, DestroyWindow, DefWindowProcA, FindWindowA, FindWindowExA, GetCursor, GetActiveWindow, GetDlgItem, GetCapture > GDI32.dll: TextOutA, SetGraphicsMode, GetBkColor, CreateSolidBrush, SetBitmapBits, ResizePalette, GetObjectType, UpdateColors ( 5 exports ) _Aje20A@@YAHHPADHHH@Z, _Aje22C@@YAHHPADHHH@Z, _Aje25F@@YAHHPADHHH@Z, _Aje26G@@YAHHPADHHH@Z, _Aje29J@@YAHHPADHHH@Z 
RDS...: NSRL Reference Data Set -
pdfid.: -
trid..: Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned 
Symantec Reputation Network: Suspicious.Insight http://www.symantec.com/security_response/writeup.jsp?docid=2010-021223-0550-99
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=EA993F9704D4DBCCA2530028692A400091BC0500' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=EA993F9704D4DBCCA2530028692A400091BC0500</a>

File AppleSyncNotifier_.exe received on 2010.04.14 15:41:46 (UTC)Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.04.14 -
AhnLab-V3 5.0.0.2 2010.04.13 -
AntiVir 7.10.6.76 2010.04.14 -
Antiy-AVL 2.0.3.7 2010.04.14 -
Authentium 5.2.0.5 2010.04.14 -
Avast 4.8.1351.0 2010.04.14 -
Avast5 5.0.332.0 2010.04.14 -
AVG 9.0.0.787 2010.04.14 -
BitDefender 7.2 2010.04.14 -
CAT-QuickHeal 10.00 2010.04.14 -
ClamAV 0.96.0.3-git 2010.04.14 -
Comodo 4596 2010.04.14 -
DrWeb 5.0.2.03300 2010.04.14 -
eSafe 7.0.17.0 2010.04.14 -
eTrust-Vet 35.2.7425 2010.04.14 -
F-Prot 4.5.1.85 2010.04.14 -
F-Secure 9.0.15370.0 2010.04.14 -
Fortinet 4.0.14.0 2010.04.12 -
GData 19 2010.04.14 -
Ikarus T3.1.1.80.0 2010.04.14 -
Jiangmin 13.0.900 2010.04.13 -
Kaspersky 7.0.0.125 2010.04.14 -
McAfee 5.400.0.1158 2010.04.14 -
McAfee-GW-Edition 6.8.5 2010.04.14 -
Microsoft 1.5605 2010.04.14 -
NOD32 5028 2010.04.14 -
Norman 6.04.11 2010.04.14 -
nProtect 2010-04-14.01 2010.04.14 -
Panda 10.0.2.7 2010.04.13 -
PCTools 7.0.3.5 2010.04.14 -
Prevx 3.0 2010.04.14 -
Rising 22.43.02.04 2010.04.14 -
Sophos 4.52.0 2010.04.14 -
Sunbelt 6175 2010.04.14 -
Symantec 20091.2.0.41 2010.04.14 -
TheHacker 6.5.2.0.261 2010.04.14 -
TrendMicro 9.120.0.1004 2010.04.14 -
VBA32 3.12.12.4 2010.04.14 -
ViRobot 2010.4.14.2276 2010.04.14 -
VirusBuster 5.0.27.0 2010.04.14 -

Additional information
File size: 47392 bytes
MD5 : fd89a30c8a9ff4929abc5039e6a527a4
SHA1 : b96fe541c0bd8021c42766d986cae8ee0d9f66db
SHA256: cd736791e181e5843bb0cc3e4d2d5538c092e1954afd9fdf62a8d8d49bdd7645
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x17AC timedatestamp.....: 0x4B8FAA9C (Thu Mar 4 13:42:04 2010) machinetype.......: 0x14C (Intel I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xE26 0x1000 5.80 44eff6ef5e912ab2641a1771ac32ff8a .rdata 0x2000 0xB82 0xC00 4.78 edae7e2532caba8394da9ed0acf8df11 .data 0x3000 0x3F4 0x200 1.32 f547bb090263a96ba686b26fc1102e4b .rsrc 0x4000 0x7D2C 0x7E00 5.80 47d8fb72b7a1c308d5923b7bf732e2a5 .reloc 0xC000 0x2F6 0x400 4.03 e1967dba4f6ff25d6cc6c93716bdd417 ( 3 imports ) > advapi32.dll: RegQueryValueExW, RegCloseKey, RegOpenKeyExW > kernel32.dll: GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetStartupInfoA, InterlockedCompareExchange, Sleep, RaiseException, LoadLibraryA, GetLastError, InterlockedExchange, FreeLibrary, GetProcAddress, LocalAlloc > msvcr80.dll: _adjust_fdiv, __p__commode, __p__fmode, _encode_pointer, __set_app_type, _crt_debugger_hook, __setusermatherr, _terminate@@YAXXZ, __type_info_dtor_internal_method@type_info@@QAEXXZ, _unlock, __dllonexit, _lock, _onexit, _decode_pointer, _except_handler4_common, _invoke_watson, _controlfp_s, _configthreadlocale, _initterm_e, _initterm, _acmdln, exit, _ismbblead, _XcptFilter, _exit, _cexit, __getmainargs, _amsg_exit, __3@YAXPAX@Z, __2@YAPAXI@Z, ___V@YAXPAX@Z, _wputenv, __0exception@std@@QAE@ABV01@@Z, _swprintf, __1exception@std@@UAE@XZ, __0exception@std@@QAE@ABQBD@Z, _scwprintf, _wgetenv, _CxxThrowException, __CxxFrameHandler3 ( 0 exports ) 
TrID : File type identification Win64 Executable Generic (80.9%) Win32 Executable Generic (8.0%) Win32 Dynamic Link Library (generic) (7.1%) Generic Win/DOS Executable (1.8%) DOS Executable Generic (1.8%)
ssdeep: 768:XKlSffl2k0IdkHOEg3KpHRdsxObE70j0SzzHYvkBn33QYL+bNJ:XKlQfl2kNqOEcKpUUE70j0SzzHYv0n38
sigcheck: publisher....: Apple Inc. copyright....: Copyright Apple Inc. 2009 product......: MobileMe description..: AppleSyncNotifier original name: AppleSyncNotifier.exe internal name: AppleSyncNotifier file version.: 1, 6, 8, 0 comments.....: n/a signers......: Apple Inc. VeriSign Class 3 Code Signing 2004 CA Class 3 Public Primary Certification Authority signing date.: 2:42 PM 3/4/2010 verified.....: - 
PEiD : -
RDS : NSRL Reference Data Set -

For the AdobeARM .exe, I can't send the file through virustotal. I get it to about 70 - 90 percent complete then I get an error screen with "Exception" written in bold.

dying of frustration · Apr 14, 2010

Here is the combofix log, and the kaspersky and dds will follow as soon as they are complete.

ComboFix 10-04-13.04 - Brian 04/14/2010 9:01.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.437 [GMT -7:00]
Running from: c:\documents and settings\Brian\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Brian\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\docume~1\alluse~1\applic~1\58q7uu.dat"
"c:\windows\Fonts\N2BMLre6S.com"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\alluse~1\applic~1\58q7uu.dat
c:\documents and settings\All Users\Application Data\8SOejo8n.exe
c:\windows\Fonts\N2BMLre6S.com
c:\windows\system32\dxe.txt
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At100.job
c:\windows\Tasks\At101.job
c:\windows\Tasks\At102.job
c:\windows\Tasks\At103.job
c:\windows\Tasks\At104.job
c:\windows\Tasks\At105.job
c:\windows\Tasks\At106.job
c:\windows\Tasks\At107.job
c:\windows\Tasks\At108.job
c:\windows\Tasks\At109.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At110.job
c:\windows\Tasks\At111.job
c:\windows\Tasks\At112.job
c:\windows\Tasks\At113.job
c:\windows\Tasks\At114.job
c:\windows\Tasks\At115.job
c:\windows\Tasks\At116.job
c:\windows\Tasks\At117.job
c:\windows\Tasks\At118.job
c:\windows\Tasks\At119.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At120.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At49.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At50.job
c:\windows\Tasks\At51.job
c:\windows\Tasks\At52.job
c:\windows\Tasks\At53.job
c:\windows\Tasks\At54.job
c:\windows\Tasks\At55.job
c:\windows\Tasks\At56.job
c:\windows\Tasks\At57.job
c:\windows\Tasks\At58.job
c:\windows\Tasks\At59.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At60.job
c:\windows\Tasks\At61.job
c:\windows\Tasks\At62.job
c:\windows\Tasks\At63.job
c:\windows\Tasks\At64.job
c:\windows\Tasks\At65.job
c:\windows\Tasks\At66.job
c:\windows\Tasks\At67.job
c:\windows\Tasks\At68.job
c:\windows\Tasks\At69.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At70.job
c:\windows\Tasks\At71.job
c:\windows\Tasks\At72.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
c:\windows\Tasks\At97.job
c:\windows\Tasks\At98.job
c:\windows\Tasks\At99.job

.
((((((((((((((((((((((((( Files Created from 2010-03-14 to 2010-04-14 )))))))))))))))))))))))))))))))
.

2010-04-13 06:00 . 2010-04-14 07:07 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\AskToolbar
2010-04-13 05:59 . 2010-04-13 05:59 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Conduit
2010-04-13 05:59 . 2010-04-13 06:00 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Online_Sharing
2010-04-12 21:20 . 2010-04-12 21:20 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-04-11 03:45 . 2010-04-11 03:45 -------- d-----w- c:\program files\iPod
2010-04-11 03:45 . 2010-04-11 03:46 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-11 03:42 . 2010-04-11 03:42 -------- d-----w- c:\program files\Apple Software Update
2010-04-09 06:37 . 2010-04-14 15:46 -------- d-----w- c:\program files\Inbox
2010-04-09 06:10 . 2010-04-14 04:11 -------- d-----w- c:\documents and settings\Brian\Tracing
2010-04-09 05:59 . 2010-04-09 05:59 -------- d-----w- c:\program files\Microsoft Sync Framework
2010-04-09 05:52 . 2010-04-09 05:52 -------- d-----w- c:\program files\Microsoft
2010-04-09 05:52 . 2010-04-09 05:52 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-04-09 05:44 . 2010-04-09 05:44 -------- d-----w- c:\program files\Common Files\Windows Live
2010-04-08 16:16 . 2010-04-08 16:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-04-08 16:14 . 2010-04-08 16:14 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-04-06 23:50 . 2010-04-07 22:02 32032 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-04-06 23:50 . 2010-04-07 22:01 5350944 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-04-06 23:45 . 2010-04-07 22:12 -------- d-----w- c:\documents and settings\All Users\Application Data\RegCure
2010-04-06 23:31 . 2010-04-07 21:49 -------- d-----w- c:\program files\Common Files\ParetoLogic
2010-04-06 23:31 . 2010-04-07 21:49 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-04-06 23:30 . 2010-04-06 23:30 -------- d-----w- c:\documents and settings\Brian\Local Settings\Application Data\Downloaded Installations
2010-04-06 22:52 . 2010-04-06 22:54 -------- d-----w- c:\documents and settings\Brian\Application Data\GetRightToGo
2010-04-06 21:21 . 2010-04-14 07:42 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-04-06 11:57 . 2010-04-06 11:57 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-06 11:56 . 2010-04-06 11:57 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-06 09:00 . 2010-04-06 09:00 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-04-06 04:16 . 2010-04-08 15:39 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-06 01:30 . 2010-04-07 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Pixela
2010-04-06 01:27 . 2010-04-06 01:28 -------- d-----w- c:\program files\PIXELA
2010-04-05 10:20 . 2010-04-05 10:20 -------- d-sh--w- c:\documents and settings\NetworkService\PrivacIE
2010-04-01 07:35 . 2010-04-01 07:59 -------- d-----w- c:\program files\Project64 1.6
2010-03-31 18:28 . 2010-03-31 18:28 50192 ----a-w- c:\documents and settings\Others\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-31 17:52 . 2010-03-31 17:52 -------- d-----w- c:\documents and settings\Others\Local Settings\Application Data\Mozilla
2010-03-31 17:32 . 2010-03-31 17:32 -------- d-----w- c:\documents and settings\Others\Application Data\SMART Technologies Inc
2010-03-31 17:32 . 2010-03-31 17:32 -------- d-----w- c:\documents and settings\Others\Local Settings\Application Data\Apple Computer
2010-03-31 17:32 . 2010-03-31 17:32 -------- d-----w- c:\documents and settings\Others\Local Settings\Application Data\SupportSoft
2010-03-31 17:12 . 2010-03-31 17:12 -------- d-----w- c:\documents and settings\Guest\Application Data\SMART Technologies Inc
2010-03-29 23:46 . 2010-04-12 20:22 -------- d-----w- c:\program files\DISCIPLINE
2010-03-29 19:44 . 2010-04-12 20:20 -------- d-----w- c:\program files\Kira Kira
2010-03-29 09:50 . 2010-03-29 09:50 -------- d-----w- c:\program files\directx
2010-03-29 09:37 . 2008-03-05 23:03 479752 ----a-w- c:\windows\system32\XAudio2_0.dll
2010-03-29 09:35 . 2010-03-29 09:35 -------- d-----w- c:\windows\Logs
2010-03-24 17:12 . 2010-04-02 19:59 -------- d-----w- c:\program files\Will
2010-03-18 22:30 . 2010-03-29 20:49 -------- d-----w- c:\program files\ZyX
2010-03-18 10:09 . 2010-03-18 10:09 -------- d-----w- c:\windows\system32\XPSViewer
2010-03-18 10:09 . 2010-03-18 10:09 -------- d-----w- c:\program files\MSBuild
2010-03-18 10:08 . 2010-03-18 10:08 -------- d-----w- c:\program files\Reference Assemblies
2010-03-18 10:08 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-03-18 10:07 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-03-18 10:07 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-03-18 10:07 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-03-18 10:07 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-03-18 10:07 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-03-18 10:07 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-03-18 10:07 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-03-18 10:07 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-03-18 10:07 . 2010-03-18 10:08 -------- d-----w- C:\171eaa7061309267e3f8a3d06a4eb1fd
2010-03-18 10:04 . 2010-03-18 10:04 -------- d-----w- c:\program files\Essentials Codec Pack
2010-03-18 06:12 . 2010-03-18 06:12 -------- d-----w- c:\documents and settings\Brian\Application Data\Freedom Scientific
2010-03-18 06:11 . 2010-03-18 06:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Freedom Scientific
2010-03-18 06:11 . 2010-03-18 06:11 -------- d-----w- c:\program files\ssce
2010-03-18 06:00 . 2006-02-10 04:58 256512 ----a-w- c:\windows\system32\dcmc0d0.dll
2010-03-18 06:00 . 2010-03-18 06:11 -------- d--h--w- c:\program files\Freedom Scientific Installation Information
2010-03-18 06:00 . 2010-03-18 06:00 -------- d-----w- c:\windows\system32\HJSMEM
2010-03-18 06:00 . 2010-03-18 06:11 -------- d-----w- c:\program files\Freedom Scientific
2010-03-18 05:54 . 2010-03-18 05:54 -------- d-----w- c:\program files\Bonjour
2010-03-18 05:42 . 2010-03-18 05:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Deskshare
2010-03-18 05:40 . 2010-03-18 05:40 -------- d-----w- c:\windows\XSxS
2010-03-18 05:40 . 2010-03-18 05:40 -------- d-----w- c:\program files\Xenocode
2010-03-18 05:40 . 2010-03-18 05:40 -------- d-----w- c:\documents and settings\Brian\Local Settings\Application Data\Xenocode
2010-03-18 05:39 . 2010-03-18 05:39 -------- d-----w- c:\program files\Common Files\DeskShare Shared
2010-03-18 05:39 . 2010-03-18 05:39 -------- d-----w- c:\program files\Deskshare
2010-03-18 05:38 . 2010-03-18 05:39 -------- d-----w- c:\windows\speech
2010-03-18 05:38 . 2010-03-18 05:38 -------- d-----w- c:\program files\ATTNaturalVoices
2010-03-17 09:29 . 2010-03-17 09:34 -------- d-----w- c:\program files\BBLACK
2010-03-16 09:33 . 2001-08-23 09:00 6144 -c--a-w- c:\windows\system32\dllcache\kbd101a.dll
2010-03-16 08:38 . 1999-12-17 16:13 86016 ----a-w- c:\windows\unvise32.exe
2010-03-16 08:34 . 2010-04-12 20:20 -------- d-----w- c:\program files\Yin-Yang
2010-03-16 08:00 . 2010-04-12 20:21 -------- d-----w- c:\program files\Amorous Professor Cherry
2010-03-16 07:37 . 2010-03-16 07:37 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-16 07:36 . 2010-03-16 07:58 -------- d-----w- c:\documents and settings\Brian\Application Data\DAEMON Tools Lite
2010-03-16 07:36 . 2010-03-16 07:36 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-14 16:12 . 2010-03-06 19:54 -------- d-----w- c:\program files\iTunes
2010-04-14 16:12 . 2009-12-12 19:51 -------- d-----w- c:\program files\QuickTime
2010-04-14 10:02 . 2007-12-20 09:47 56 --sh--r- c:\windows\system32\0E64EFB052.sys
2010-04-14 10:02 . 2007-12-20 09:47 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
2010-04-14 00:40 . 2007-12-06 23:56 -------- d-----w- c:\program files\dl_Cats
2010-04-13 19:56 . 2007-10-30 21:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-13 05:29 . 2004-08-10 12:00 36352 ----a-w- c:\windows\system32\drivers\disk.sys
2010-04-13 00:34 . 2004-08-10 12:00 96512 ------w- c:\windows\system32\drivers\atapi.sys
2010-04-11 03:45 . 2008-01-05 21:26 -------- d-----w- c:\program files\Common Files\Apple
2010-04-09 06:01 . 2007-12-07 00:44 50776 ----a-w- c:\documents and settings\Brian\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-09 06:00 . 2008-03-03 19:41 -------- d-----w- c:\program files\Windows Live
2010-04-09 05:59 . 2007-12-10 01:52 -------- d-----w- c:\program files\Windows Live Toolbar
2010-04-08 15:50 . 2008-08-20 00:19 -------- d-----w- c:\program files\AVG
2010-04-08 15:50 . 2008-08-20 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2010-04-07 21:55 . 2009-06-25 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-04-06 23:59 . 2010-04-06 23:59 125952 ----a-w- c:\documents and settings\All Users\Application Data\ParetoLogic\UUS2\Temp\Update.exe
2010-04-06 23:50 . 2010-04-06 23:50 32 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-04-06 23:50 . 2010-04-06 23:50 32 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-04-06 23:14 . 2010-04-06 22:49 79488 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\jre1.6.0_19\gtapi.dll
2010-04-06 23:14 . 2010-04-06 22:49 152576 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\jre1.6.0_19\lzma.dll
2010-04-06 22:53 . 2008-12-15 17:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-04-06 22:43 . 2008-03-05 17:38 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-06 02:05 . 2007-10-30 20:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-06 01:19 . 2009-01-03 20:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-06 01:19 . 2009-01-15 06:40 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-05 09:52 . 2008-11-11 22:35 1 ----a-w- c:\documents and settings\Brian\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-01 04:14 . 2010-04-01 04:14 61440 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-72781112-n\decora-sse.dll
2010-04-01 04:14 . 2010-04-01 04:14 503808 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-70ee7950-n\msvcp71.dll
2010-04-01 04:14 . 2010-04-01 04:14 499712 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-70ee7950-n\jmc.dll
2010-04-01 04:14 . 2010-04-01 04:14 348160 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-70ee7950-n\msvcr71.dll
2010-04-01 04:14 . 2010-04-01 04:14 12800 ----a-w- c:\documents and settings\Others\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-72781112-n\decora-d3d.dll
2010-03-30 07:46 . 2009-01-03 20:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 07:45 . 2009-01-03 20:22 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-29 07:08 . 2008-02-07 18:42 -------- d-----w- c:\documents and settings\Brian\Application Data\Jasc Software Inc
2010-03-26 08:48 . 2010-03-26 08:48 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-03-24 18:17 . 2010-03-24 08:04 952768 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AdobeARM.exe
2010-03-24 18:17 . 2010-03-24 08:04 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AdobeExtractFiles.dll
2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\ReaderUpdater.exe
2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AcrobatUpdater.exe
2010-03-18 22:15 . 2008-03-25 03:09 -------- d-----w- c:\program files\CCleaner
2010-03-18 22:01 . 2008-05-22 16:37 -------- d-----w- c:\documents and settings\Brian\Application Data\Uniblue
2010-03-18 20:43 . 2009-01-10 08:32 -------- d-----w- c:\program files\VideoLAN
2010-03-18 06:25 . 2008-04-23 18:40 2000000 ----atw- c:\windows\system32\HJSMEM.DAT
2010-03-18 05:55 . 2009-09-06 23:53 -------- d-----w- c:\program files\Safari
2010-03-16 09:59 . 2010-03-16 09:59 29926 ----a-r- c:\documents and settings\Brian\Application Data\Microsoft\Installer\{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_18be6784.exe
2010-03-16 09:59 . 2010-03-16 09:59 29422 ----a-r- c:\documents and settings\Brian\Application Data\Microsoft\Installer\{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_294823.exe
2010-03-11 10:03 . 2008-10-19 07:58 -------- d-----w- c:\program files\ffdshow
2010-03-11 10:03 . 2008-05-22 16:19 -------- d-----w- c:\program files\Free Offers from Freeze.com
2010-03-10 21:19 . 2007-12-07 05:27 -------- d-----w- c:\documents and settings\All Users\Application Data\SupportSoft
2010-03-05 11:47 . 2008-10-10 19:00 -------- d-----w- c:\documents and settings\Brian\Application Data\Move Networks
2010-03-04 11:45 . 2007-12-09 20:35 -------- d-----w- c:\program files\DivX
2010-03-04 11:43 . 2009-10-27 02:16 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-03-04 11:00 . 2010-03-04 11:00 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-02 05:33 . 2009-06-23 04:32 315736 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-03-02 05:33 . 2009-06-23 04:32 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2010-03-02 05:33 . 2009-06-23 04:32 173408 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-03-02 05:33 . 2009-06-02 04:33 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-02 05:33 . 2009-06-23 04:32 350544 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-03-02 05:33 . 2009-06-23 04:32 303456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-03-02 05:33 . 2009-06-23 04:32 1630560 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-02 05:33 . 2009-06-02 04:33 89952 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-03-02 05:33 . 2009-06-02 04:32 254832 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-03-02 05:32 . 2009-06-23 04:32 671592 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-03-02 05:32 . 2009-06-02 04:32 45408 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-03-02 05:32 . 2009-09-29 04:32 3701760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-03-02 05:32 . 2009-06-23 04:32 566648 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-03-02 05:32 . 2009-06-23 04:32 567144 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-03-02 05:32 . 2009-06-23 04:32 2357064 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-03-02 05:32 . 2009-06-23 04:32 524632 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-03-02 05:32 . 2009-06-23 04:32 1029456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-03-01 05:41 . 2010-03-01 05:41 -------- d-----w- c:\program files\NaturalSoft
2010-02-25 06:24 . 2004-08-10 12:00 916480 ------w- c:\windows\system32\wininet.dll
2010-02-23 13:45 . 2010-02-22 22:10 7 ----a-w- c:\windows\sbacknt.bin
2010-02-23 06:28 . 2010-02-23 05:58 -------- d-----w- c:\documents and settings\Brian\Application Data\Toolbar4
2010-02-23 05:40 . 2010-02-23 05:40 -------- d-----w- c:\program files\Conduit
2010-02-23 05:40 . 2010-02-23 05:40 -------- d-----w- c:\program files\Online_Sharing
2010-02-17 00:11 . 2007-10-30 21:09 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-14 09:36 . 2010-02-14 09:36 -------- d-----w- c:\program files\RADVideo
2010-02-14 09:28 . 2010-02-14 09:28 -------- d-----w- c:\program files\Common Files\Common Share
2010-02-12 18:46 . 2010-02-12 18:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46 . 2010-02-12 18:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-02-04 17:01 . 2010-03-29 09:38 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 17:01 . 2010-03-29 09:38 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 17:01 . 2010-03-29 09:38 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 17:01 . 2010-03-29 09:38 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-01-27 08:08 . 2008-10-19 07:58 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-01-27 05:38 . 2010-01-27 05:38 348160 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4f12d232-n\msvcr71.dll
2010-01-27 05:38 . 2010-01-27 05:38 61440 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-126fe1bb-n\decora-sse.dll
2010-01-27 05:38 . 2010-01-27 05:38 503808 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4f12d232-n\msvcp71.dll
2010-01-27 05:38 . 2010-01-27 05:38 499712 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4f12d232-n\jmc.dll
2010-01-27 05:38 . 2010-01-27 05:38 12800 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-126fe1bb-n\decora-d3d.dll
.

Code:

<pre>
c:\program files\Adobe\Reader 9.0\Reader\Reader_sl .exe
c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\QuickTime\qttask .exe
c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer .exe
c:\windows\ime\imjp8_1\IMJPMIG .exe
c:\windows\ime\imkr6_1\IMEKRMIG .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8567a644-e36c-470c-86cf-9c5b4f37db81}]
2009-12-31 19:53 2349080 ----a-w- c:\program files\Online_Sharing\tbOnli.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 21:03 1230080 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
"{8567a644-e36c-470c-86cf-9c5b4f37db81}"= "c:\program files\Online_Sharing\tbOnli.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CLASSES_ROOT\clsid\{8567a644-e36c-470c-86cf-9c5b4f37db81}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{8567A644-E36C-470C-86CF-9C5B4F37DB81}"= "c:\program files\Online_Sharing\tbOnli.dll" [2009-12-31 2349080]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{8567a644-e36c-470c-86cf-9c5b4f37db81}]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr .exe" [N/A]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [N/A]
"LxrAutorun"="c:\documents and settings\Brian\Local Settings\Application Data\Lexar Media\LxrAutorun.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QUICKCARE"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-08 192512]
"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-06-07 69632]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-14 41492]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-14 41492]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-14 41492]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2001-08-23 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-04-14 41492]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-04-14 41492]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-14 41492]

c:\documents and settings\Brian\Start Menu\Programs\Startup\
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-6-24 803176]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
ImageMixer 3 SE Camera Monitor Ver.4.5.lnk - c:\program files\PIXELA\ImageMixer 3 SE Ver.4.5\Transfer Utility\CameraMonitor.exe [2010-4-5 406896]
SMART Board Tools.lnk - c:\program files\SMART Technologies Inc\SMART Board Software\SMARTBoardTools.exe [2007-11-2 4519176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-16 19:50 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2006-02-10 05:05 344064 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlccmon.exe]
2005-07-22 19:03 425984 ----a-w- c:\program files\Dell Photo AIO Printer 924\dlccmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 21:56 64512 ----a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-06-16 14:03 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-06-16 14:03 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-04-14 16:12 41492 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
c:\program files\Windows Live\Messenger\msnmsgr.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QUICKCARE]
2006-11-08 04:07 192512 ----a-w- c:\program files\Qwest\QuickCare\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-04-14 16:12 41492 ----a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2005-03-23 01:20 339968 ----a-w- c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 23:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-04-14 16:12 41492 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
2008-08-28 17:18 3660848 ----a-w- c:\program files\Veoh Networks\Veoh\VeohClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"SPF4"=2 (0x2)
"IDriverT"=3 (0x3)
"gusvc"=3 (0x3)
"dlcc_device"=3 (0x3)
"BOCore"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\WINDOWS\\system32\\dlcccoms.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Guild Wars\\Gw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1/31/2009 10:32 PM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/3/2009 12:41 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/3/2009 12:41 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [1/3/2009 12:41 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/3/2009 12:41 PM 297752]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [9/24/2009 8:15 PM 72672]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;\??\c:\program files\VMLaunch\BuddyVM.sys --> c:\program files\VMLaunch\BuddyVM.sys [?]
S2 gupdate1ca56ab8e11c5ea;Google Update Service (gupdate1ca56ab8e11c5ea);c:\program files\Google\Update\GoogleUpdate.exe [10/26/2009 7:16 PM 133104]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [10/30/2007 12:56 PM 20160]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 2:34 PM 1029456]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 5:20 AM 12648]
S3 SMART Web Server;SMART Web Server;c:\program files\SMART Technologies Inc\SMART Board Software\WebServer.exe [11/2/2007 6:48 AM 767240]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/16/2010 12:37 AM 691696]
.
Contents of the 'Scheduled Tasks' folder

2010-04-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 05:32]

2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 18:50]

2010-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-27 02:16]

2010-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-27 02:16]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.live.com/
mStart Page = hxxp://www.bigseekpro.com/webscout/{213687C0-A8F8-4791-AD1C-94B40145C34C}
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Inbox Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Inbox\ctbr.dll
FF - ProfilePath - c:\documents and settings\Brian\Application Data\Mozilla\Firefox\Profiles\x3ydlwy6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15153&l=dis
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Inbox\firefox\components\xcomm.dll
FF - component: c:\program files\Inbox\firefox\components\xshared.dll
FF - component: c:\program files\Inbox\firefox\components\xsupport.dll
FF - plugin: c:\documents and settings\Brian\Application Data\Move Networks\plugins\npqmp071505000010.dll
FF - plugin: c:\documents and settings\Brian\Application Data\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-14 09:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5d,1a,f6,c6,ac,aa,3a,48,98,4a,c9,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5d,1a,f6,c6,ac,aa,3a,48,98,4a,c9,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1316)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\windows\system32\LxrSII1s.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer .exe
c:\program files\SMART Technologies Inc\SMART Board Software\Aware.exe
c:\program files\SMART Technologies Inc\SMART Board Software\Marker.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-04-14 09:20:36 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-14 16:20
ComboFix2.txt 2010-04-14 08:00
ComboFix3.txt 2010-04-13 19:56

Pre-Run: 21,239,205,888 bytes free
Post-Run: 21,317,124,096 bytes free

- - End Of File - - 21B6B2DA2A21F23A71E7B942D58F39E0

Blade81 · Apr 14, 2010

Hi,

For the AdobeARM .exe, I can't send the file through virustotal. I get it to about 70 - 90 percent complete then I get an error screen with "Exception" written in bold.

Please try again and if it still fails, see if http://virscan.org works.

Shall wait for those other reports.

dying of frustration · Apr 14, 2010

I tried the file again with virustotal, but it still didn't work, unfortunately. However, it did work with virscan.
Here are the results:

VirSCAN.org Scanned Report :
Scanned time : 2010/01/14 17:16:53 (PST)
Scanner results: Scanners did not find malware!
File Name : AdobeARM.exe
File Size : 935288 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 3103fe27c967675b019e880aa6da3d6d
SHA1 : 79a198f891f7def459fe866679034ecf2f6f9347
Online report : http://virscan.org/report/a1c66921079a40863ba0f356e587b388.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20100115033122 2010-01-15 4.81 -
AhnLab V3 2010.01.15.00 2010.01.15 2010-01-15 1.07 -
AntiVir 8.2.1.142 7.10.2.195 2010-01-14 0.37 -
Antiy 2.0.18 20100112.3695772 2010-01-12 0.12 -
Arcavir 2009 201001141342 2010-01-14 0.11 -
Authentium 5.1.1 201001141649 2010-01-14 3.29 -
AVAST! 4.7.4 100114-1 2010-01-14 0.05 -
AVG 8.5.288 270.14.141/2622 2010-01-15 0.36 -
BitDefender 7.81008.4857170 7.29883 2010-01-15 4.17 -
CA (VET) 35.1.0 7235 2010-01-13 8.69 -
ClamAV 0.95.2 10299 2010-01-14 0.17 -
Comodo 3.13.579 3409 2010-01-14 0.91 -
CP Secure 1.3.0.5 2010.01.14 2010-01-14 0.12 -
Dr.Web 4.44.0.9170 2010.01.14 2010-01-14 8.87 -
F-Prot 4.4.4.56 20100114 2010-01-14 3.09 -
F-Secure 7.02.73807 2010.01.14.13 2010-01-14 0.17 -
Fortinet 11.373- 11.373 2010-01-14 0.24 -
GData 19.9969/19.676 20100115 2010-01-15 5.76 -
ViRobot 20100114 2010.01.14 2010-01-14 0.41 -
Ikarus T3.1.01.80 2010.01.14.74965 2010-01-14 5.57 -
JiangMin 13.0.900 2010.01.13 2010-01-13 5.02 -
Kaspersky 5.5.10 2010.01.14 2010-01-14 0.11 -
KingSoft 2009.2.5.15 2010.1.14.23 2010-01-14 0.65 -
McAfee 5.3.00 5861 2010-01-14 3.38 -
Microsoft 1.5302 2010.01.14 2010-01-14 6.90 -
Norman 6.01.09 6.01.00 2010-01-14 4.01 -
Panda 9.05.01 2010.01.14 2010-01-14 2.09 -
Trend Micro 9.120-1004 6.768.09 2010-01-14 0.13 -
Quick Heal 10.00 2010.01.14 2010-01-14 1.59 -
Rising 20.0 22.30.03.04 2010-01-14 1.07 -
Sophos 3.03.0 4.49 2010-01-15 3.09 -
Sunbelt 3.9.2390.2 5618 2010-01-14 2.26 -
Symantec 1.3.0.24 20100112.005 2010-01-12 0.00 -
nProtect 20100114.03 6880842 2010-01-14 4.11 -
The Hacker 6.5.0.3 v00151 2010-01-14 0.76 -
VBA32 3.12.12.1 20100114.1231 2010-01-14 2.58 -
VirusBuster 4.5.11.10 10.119.4/2025813 2010-01-15 3.20 -

I am still waiting on the kaspersky scan. It seems to be taking forever to complete. I'll post when it's done.:bigthumb:

dying of frustration · Apr 15, 2010

Alright I finally have the Kaspersky scan done. Here it is, followed by the new dds log.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, April 14, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, April 14, 2010 17:09:03
Records in database: 3943728
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 124633
Threats found: 3
Infected objects found: 3
Suspicious objects found: 0
Scan duration: 08:20:28

File name / Threat / Threats count
C:\Documents and Settings\Brian\Desktop\usmc\SKELTON (F)\Autorun.inf Infected: Worm.Win32.VB.fi 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\disk.sys.vir Infected: Rootkit.Win32.TDSS.ap 1
C:\System Volume Information\_restore{4188D92D-190B-458C-9C83-7E2B0997B9E9}\RP409\A0035905.exe Infected: not-a-virus:AdWare.Win32.AzSearch.j 1

Selected area has been scanned.

DDS (Ver_10-03-17.01) - NTFSx86
Run by Brian at 22:56:35.89 on Wed 04/14/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_19
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.388 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\LxrSII1s.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PIXELA\ImageMixer 3 SE Ver.4.5\Transfer Utility\CameraMonitor.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardTools.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\Aware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\Marker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Inbox\CToolbar.exe
c:\PROGRA~1\Inbox\CMail.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Documents and Settings\All Users\Application Data\8SOejo8n.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Brian\My Documents\Downloads\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.live.com/
mStart Page = hxxp://www.bigseekpro.com/webscout/{213687C0-A8F8-4791-AD1C-94B40145C34C}
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: : {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - c:\progra~1\inbox\ctbr.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: CIEDownload Object: {67bcf957-85fc-4036-8dc4-d4d80e00a77b} - c:\program files\smart technologies inc\notebook software\NotebookPlugin.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Online Sharing Toolbar: {8567a644-e36c-470c-86cf-9c5b4f37db81} - c:\program files\online_sharing\tbOnli.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\program files\megaupload\mega manager\MegaIEMn.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Veoh Browser Plug-in: {d0943516-5076-4020-a3b5-aefaf26ab263} - c:\program files\veoh networks\veoh\plugins\reg\VeohToolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Veoh Web Player Video Finder: {0fbb9689-d3d7-4f7a-a2e2-585b10099bfc} - c:\program files\veoh networks\veohwebplayer\VeohIEToolbar.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: Online Sharing Toolbar: {8567a644-e36c-470c-86cf-9c5b4f37db81} - c:\program files\online_sharing\tbOnli.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Inbox.com Toolbar: {4b3803ea-5230-4dc3-a7fc-33638f3d3542} - c:\progra~1\inbox\ctbr.dll
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr .exe" /background
uRun: [VeohPlugin] "c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe"
uRun: [LxrAutorun] c:\documents and settings\brian\local settings\application data\lexar media\LxrAutorun.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~2.EXE -Update -1103472 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; Media Center PC 4.0; MSN Optimized;US)" -"http://www.regentsprep.org/Regents/physics/phys01/friction/default.htm"
mRun: [QUICKCARE] c:\program files\qwest\quickcare\bin\sprtcmd.exe /P QUICKCARE
mRun: [DLCCCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCCtime.dll,_RunDLLEntry@16
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\docume~1\brian\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\imagem~1.lnk - c:\program files\pixela\imagemixer 3 se ver.4.5\transfer utility\CameraMonitor.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\smartb~1.lnk - c:\program files\smart technologies inc\smart board software\SMARTBoardTools.exe
IE: Inbox Search - tbr:iemenu
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1234169145515
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\inbox\ctbr.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\brian\applic~1\mozilla\firefox\profiles\x3ydlwy6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com?o=15153&l=dis
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\inbox\firefox\components\xcomm.dll
FF - component: c:\program files\inbox\firefox\components\xshared.dll
FF - component: c:\program files\inbox\firefox\components\xsupport.dll
FF - plugin: c:\documents and settings\brian\application data\move networks\plugins\npqmp071505000010.dll
FF - plugin: c:\documents and settings\brian\application data\move networks\plugins\npqmp071701000002.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\veoh networks\veoh\plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-1-31 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-3 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-1-3 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-1-3 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-1-3 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-3 297752]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [2009-9-24 72672]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;\??\c:\program files\vmlaunch\buddyvm.sys --> c:\program files\vmlaunch\BuddyVM.sys [?]
S2 gupdate1ca56ab8e11c5ea;Google Update Service (gupdate1ca56ab8e11c5ea);c:\program files\google\update\GoogleUpdate.exe [2009-10-26 133104]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2007-10-30 20160]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 1029456]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]
S3 SMART Web Server;SMART Web Server;c:\program files\smart technologies inc\smart board software\WebServer.exe [2007-11-2 767240]

=============== Created Last 30 ================

2010-04-14 18:15:45 71170 ----a-w- c:\docume~1\alluse~1\applic~1\8SOejo8n.exe
2010-04-14 18:15:41 112 ----a-w- c:\docume~1\alluse~1\applic~1\58q7uu.dat
2010-04-14 15:59:46 0 d-----w- C:\ComboFix
2010-04-13 19:34:08 98816 ----a-w- c:\windows\sed.exe
2010-04-13 19:34:08 77312 ----a-w- c:\windows\MBR.exe
2010-04-13 19:34:08 261632 ----a-w- c:\windows\PEV.exe
2010-04-13 19:34:08 161792 ----a-w- c:\windows\SWREG.exe
2010-04-13 19:07:09 176 ----a-w- c:\documents and settings\brian\defogger_reenable
2010-04-13 14:35:35 9 ----a-w- c:\windows\system32\Class14
2010-04-13 14:35:35 5 ----a-w- c:\windows\system32\Band4
2010-04-11 03:45:51 0 d-----w- c:\program files\iPod
2010-04-11 03:45:29 0 d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-09 06:37:04 0 d-----w- c:\program files\Inbox
2010-04-09 06:10:01 0 d-----w- c:\documents and settings\brian\Tracing
2010-04-09 05:52:50 0 d-----w- c:\program files\Microsoft
2010-04-09 05:52:22 0 d-----w- c:\program files\Windows Live SkyDrive
2010-04-09 05:44:25 0 d-----w- c:\program files\common files\Windows Live
2010-04-06 23:50:07 5350944 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-04-06 23:50:07 32032 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-04-06 23:50:07 32 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-04-06 23:50:07 32 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-04-06 23:49:46 1356 ----a-w- C:\rollback.ini
2010-04-06 23:45:41 0 d-----w- c:\docume~1\alluse~1\applic~1\RegCure
2010-04-06 23:31:10 0 d-----w- c:\program files\common files\ParetoLogic
2010-04-06 23:31:10 0 d-----w- c:\docume~1\alluse~1\applic~1\ParetoLogic
2010-04-06 22:52:14 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-04-06 22:52:14 0 d-----w- c:\docume~1\brian\applic~1\GetRightToGo
2010-04-06 21:21:06 0 d-----w- c:\program files\DAEMON Tools Lite
2010-04-06 11:57:31 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-06 11:56:46 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-06 01:30:39 0 d-----w- c:\docume~1\alluse~1\applic~1\Pixela
2010-04-06 01:27:52 0 d-----w- c:\program files\PIXELA
2010-04-01 07:35:13 0 d-----w- c:\program files\Project64 1.6
2010-03-29 23:46:03 0 d-----w- c:\program files\DISCIPLINE
2010-03-29 19:44:50 0 d-----w- c:\program files\Kira Kira
2010-03-29 09:50:40 0 d-----w- c:\program files\directx
2010-03-29 09:37:58 479752 ----a-w- c:\windows\system32\XAudio2_0.dll
2010-03-29 09:35:24 0 d-----w- c:\windows\Logs
2010-03-29 06:41:27 754 ----a-w- c:\windows\WORDPAD.INI
2010-03-24 17:12:42 0 d-----w- c:\program files\Will
2010-03-18 22:30:29 0 d-----w- c:\program files\ZyX
2010-03-18 19:34:16 1089593 -c----w- c:\windows\system32\dllcache\ntprint.cat
2010-03-18 10:09:17 0 d-----w- c:\windows\system32\XPSViewer
2010-03-18 10:07:43 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-03-18 10:07:43 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-03-18 10:07:43 117760 ------w- c:\windows\system32\prntvpt.dll
2010-03-18 10:07:42 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-03-18 10:07:42 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-03-18 10:07:42 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-03-18 10:07:42 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-03-18 10:07:40 0 d-----w- C:\171eaa7061309267e3f8a3d06a4eb1fd
2010-03-18 10:04:14 0 d-----w- c:\program files\Essentials Codec Pack
2010-03-18 06:12:44 0 d-----w- c:\docume~1\brian\applic~1\Freedom Scientific
2010-03-18 06:11:23 0 d-----w- c:\docume~1\alluse~1\applic~1\Freedom Scientific
2010-03-18 06:11:14 0 d-----w- c:\program files\ssce
2010-03-18 06:00:18 256512 ----a-w- c:\windows\system32\dcmc0d0.dll
2010-03-18 06:00:13 0 d--h--w- c:\program files\Freedom Scientific Installation Information
2010-03-18 06:00:12 0 d-----w- c:\windows\system32\HJSMEM
2010-03-18 06:00:05 0 d-----w- c:\program files\Freedom Scientific
2010-03-18 05:54:10 0 d-----w- c:\program files\Bonjour
2010-03-18 05:42:49 0 d-----w- c:\docume~1\alluse~1\applic~1\Deskshare
2010-03-18 05:40:56 0 d-----w- c:\windows\XSxS
2010-03-18 05:40:56 0 d-----w- c:\program files\Xenocode
2010-03-18 05:39:58 0 d-----w- c:\program files\common files\DeskShare Shared
2010-03-18 05:39:57 0 d-----w- c:\program files\Deskshare
2010-03-18 05:38:59 0 d-----w- c:\windows\speech
2010-03-18 05:38:42 0 d-----w- c:\program files\ATTNaturalVoices
2010-03-18 04:53:42 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-03-18 04:53:42 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-03-17 09:30:12 301 ----a-w- c:\windows\ACTIVEJP.INI
2010-03-17 09:29:52 0 d-----w- c:\program files\BBLACK
2010-03-16 09:33:13 82172 -c--a-w- c:\windows\system32\dllcache\bopomofo.nls
2010-03-16 08:38:21 86016 ----a-w- c:\windows\unvise32.exe
2010-03-16 08:34:43 0 d-----w- c:\program files\Yin-Yang
2010-03-16 08:00:10 0 d-----w- c:\program files\Amorous Professor Cherry
2010-03-16 07:37:15 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-16 07:36:21 0 d-----w- c:\docume~1\brian\applic~1\DAEMON Tools Lite
2010-03-16 07:36:17 0 d-----w- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite

==================== Find3M ====================

2010-04-14 10:02:38 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys
2010-04-13 05:29:00 36352 ----a-w- c:\windows\system32\drivers\disk.sys
2010-04-13 00:34:16 96512 ------w- c:\windows\system32\drivers\atapi.sys
2010-04-06 22:53:43 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-30 07:46:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 07:45:52 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-18 06:25:31 2000000 ----atw- c:\windows\system32\HJSMEM.DAT
2010-02-25 06:24:37 916480 ------w- c:\windows\system32\wininet.dll
2010-02-12 18:46:14 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46:14 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-02-04 17:01:14 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 17:01:14 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 17:01:14 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 17:01:14 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-01-27 08:08:58 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2008-09-18 18:40:45 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090120080908\index.dat
2008-09-18 19:11:29 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091820080919\index.dat

============= FINISH: 22:57:34.43 ===============

Need Help with "Your Protection" Virus

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

New member

New member